1. Use of Cloud Services; Issues Arising from Use of Online Data from or Concerning Users MCLE New England 2pm – 5pm on January 28 th, 2016 David G. Rickerby

2. Discussion Topics 2:15 - 2:55 p.m. Use of Cloud Services; Issues Arising from Use of Online Data from or Concerning Users 3:50 - 4:10 p.m. Use of Open Source Software

3. Agenda Using Cloud Services to Run your Business Privacy Big Data

4. Introduction to the Cloud

5. Layered Services … Software as a service (SaaS) – rented finished applications Platform as a service (PaaS) – standardized developer and app platform that abstracts the infrastructure and middleware to drive developer productivity Infrastructure as a service (IaaS) – Standardized and virtualized infrastructure, hardware, software and services can operate any set of applications Saas is being built on Paas and Iaas, but SaaS companies can also operate their own server farms.

6. Introduction to the Cloud SaaS PaaS

7. Layered Services … Layered Terms Try not to get caught between your vendors’ terms and what you offer. “We can’t give better terms than we get.” Walking through a few samples. Note – Your terms may be different. Terms change all the time and these sites have multiple services.

8. Three classic negotiated issues and how they play in the cloud… Uptime and Service Level Credits Third Party Clearances Disentanglement

9. Uptime and Service Level Credits Classic Negotiated – – Highly negotiated. Generally 99.5% uptime with credits ranging from 5%-20% of fees paid in the given month. Cloudy – – Rackspace – 3. CLOUD DATABASE INSTANCES SERVICE LEVEL GUARANTEE. We guarantee that your Cloud Database Instance(s) will be available 99.9% of the time in any given monthly billing period. If we fail to meet this guarantee, you will be eligible for a credit calculated as a percentage of the Service Fees, as follows: Five percent (5%) of the Service Fees for each 30 minutes of Cloud Database Instance unavailability, after the first 0.1% of unavailability during the month, up to one hundred percent (100%) of the Service Fees. You shall not be entitled to a credit if (ii) the event giving rise to the credit would not have occurred but for the resizing any Cloud Database Instance(s) upon your instructions (including by increasing or decreasing the amount of storage or compute resources dedicated to a given Cloud Database Instance), or (ii) where the applicable Cloud Database Instance(s) are root enabled.

10. Uptime and Service Level Credits Salesforce: 3.1. Provision of Purchased Services. We will … (c) use commercially reasonable efforts to make the online Services available 24 hours a day, 7 days a week, except for: (i) planned downtime (of which We shall give advance electronic notice as provided in the Documentation), and (ii) any unavailability caused by circumstances beyond Our reasonable control, including, for example, an act of God, act of government, flood, fire, earthquake, civil unrest, act of terror, strike or other labor problem (other than one involving Our employees), Internet service provider failure or delay, Non-SFDC Application, or denial of service attack.

11. Uptime and Service Level Credits The calculations are complex And the exceptions are largely the same: force majeure scheduled downtime must report within x days “You must show that your use of the Cloud Servers was adversely affected in some way as a result of the downtime to be eligible for the credit.” – (old) Rackspace

12. Third Party Clearances Classic Negotiated - – You have to rep and warrant that no third party software is used. If it is used, you are usually forced into representing and warranting regarding its performance and infringement. – You usually must identify all open source. Cloudy – – Multiple nested agreements – when you start using the service, you start doing business with a number of different companies depending on which functionality you use. All with different terms – many of which may get automatically amended for continued use

13. Third Party Clearances 4.1. You are responsible for maintaining licenses and adhering to the license terms of any software you run. 4.2. Using Microsoft Software. As part of the Services, you may be allowed to use certain software (including related documentation) developed and owned by Microsoft Corporation or its licensors (collectively, the “Microsoft Software”). If you choose to use the Microsoft Software, Microsoft and its licensors require that you agree to these additional terms and conditions: … 4.3. Using IBM Software. As part of the Services, you may be allowed to use certain software (including related documentation) developed and owned by International Business Machines Corporation or its licensors (collectively, the “IBM Software”). If you choose to use the IBM Software, IBM and its licensors require that you agree to the additional terms and conditions: … 4.4. Using Novell Software. As part of the Services, you may be allowed to use certain software (including related documentation) developed and owned by Novell, Inc. or its licensors (collectively, the “Novell Software”). If you choose to use the Novell Software, Novell and its licensors require that you agree to these additional terms and conditions: Your use of the Novell Software is subject to the terms and conditions of the Novell End User License Agreement (“Novell EULA”) provided with the Novell Software. By using the Novell Software, you hereby agree to be bound by the terms of the applicable Novell EULA, which is presented the first time you access the relevant machine image. 4.5. Using Red Hat Software. As part of the Services, you may be allowed to use certain software (including related support, maintenance, and documentation) developed, owned or provided by Red Hat, Inc. or its licensors (collectively, the “Red Hat Software”). If you choose to use the Red Hat Software, Red Hat and its licensors require that you agree to these additional terms and conditions: … Your use of the Red Hat Software is subject to the terms and conditions of the Red Hat Cloud Software Subscription Agreement currently located at www.redhat.com/licenses/cloud_cssa/ (the “Red Hat CSSA”). By using the Red Hat Software, you hereby agree to be bound by the terms of the Red Hat CSSA.

14. Third Party Clearances 5. NON-SALESFORCE.COM PROVIDERS 5.1. We or third parties may make available (for example, through a Marketplace or otherwise) third-party products or services, including, for example, Non-SFDC Applications and implementation and other consulting services. Any acquisition by You of such products or services, and any exchange of data between You and any Non- SFDC provider, product or service is solely between You and the applicable Non-SFDC provider. We do not warrant or support NonSFDC Applications or other Non-SFDC products or services, whether or not they are designated by Us as “certified” or otherwise, unless expressly provided otherwise in an Order Form. except as specified in an Order Form. …. 5.3. Integration with Non-SFDC Applications. The Services may contain features designed to interoperate with Non-SFDC Applications. To use such features, You may be required to obtain access to such Non-SFDC Applications from their providers, and may be required to grant Us access to Your account(s) on such Non-SFDC Applications. We cannot guarantee the continued availability of such Service features, and may cease providing them without entitling You to any refund, credit, or other compensation, if for example and without limitation, the provider of a Non-SFDC Application ceases to make the Non-SFDC Application available for interoperation with the corresponding Service features in a manner acceptable to Us.

15. Classic Negotiated - – Transition of the service negotiated on a bespoke basis based on the services. Customer asks include: ● require the vendor promptly, efficiently, and at MFN type rates translate and transition data and custom applications. ● perpetually royalty free license to any API or vendor owned code that had been built into customer apps. Disentanglement

16. Cloudy – 12.5. Your Data Portability and Deletion. Upon request by You made within 30 days after the effective date of termination or expiration of this Agreement, We will make Your Data available to You for export or download as provided in the Documentation. After such 30-day period, We will have no obligation to maintain or provide any Your Data, and as provided in the Documentation will thereafter delete or destroy all copies of Your Data in Our systems or otherwise in Our possession or control, unless legally prohibited. Disentanglement

17. – Rackspace: – ACCESS TO DATA. – 13.1 You will not have access to your data stored on the Services during a suspension or following termination.

18. Privacy Intro Privacy in Massachusetts Privacy Issues in the Cloud

19. Introduction to Privacy Laws regulating personally identifiable information (PII) collected by public, private and government entities and the storage and use of the information.

20. What is PII? Name, such as full name Social Security Number Address Personality characteristics: fingerprints, voice signature, retina scan. Information identifying personally owned property, such as vehicle registration number or title number and related information Information about an individual that is linked or linkable to one of the above (e.g., date of birth, place of birth, race, religion, weight, activities, geographical indicators, employment information, medical information, education information, financial information). GUIDE TO PROTECTING THE CONFIDENTIALITY OF PERSONALLY IDENTIFIABLE INFORMATION (PII), Recommendations of the National Institute of Standards and Technology

21. Introduction to Privacy Privacy Law has been continuously under revision for several decades. Defining Privacy: Varies between Courts vs. Legislature. International law plays a large role in shaping United State Privacy dialogue. – Safe Harbor Decision

22. Introduction to Privacy Sample of Relevant Laws Federal Trade Commission Act (FTC Act) Federal Laws by Industry (e.g., HIPAA, GLB) Fair Credit Reporting Act (FCRA) State data breach notification laws Other state laws

23. Introduction to Privacy FTC - Avoid “unfair or deceptive” practices. Have a written privacy policy that let’s customers know how you handle their data. Then handle it THAT WAY. Use reasonable measures to protect sensitive consumer data/PII – increasing amount of data is “sensitive” – Reasonable is based on looking at industry, type of data, intended use, size of company, etc.

24. Introduction to Privacy Privacy Law is Sector Specific Healthcare: Health Insurance Portability and Accountability Act (HIPAA) imposes specific requirements on businesses that collect and use health information Financial: The Gramm-Leach-Bliley (GLB) Privacy Rules and Safeguards Rule requires "financial institutions" to provide clear and conspicuous notice of data privacy practices and implement reasonable safeguards for customer data. Payment Card Industry: PCI Data Security Standard 8 Legal Standards

25. Introduction to Privacy Privacy Law is Decentralized and By State 47 existing state information security and breach notification laws governing the response to and reporting of data breaches. Massachusetts is among the most comprehensive statutes

26. Privacy Law in Mass Massachusetts 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth – In effect, as of January 1, 2010, Massachusetts mandated that personal information, a combination of a name along with a Social Security number, bank account number, or credit card number, be encrypted when stored on portable devices, or transmitted wirelessly or on public networks. – Businesses must utilize up-to-date firewall protection that creates an electronic gatekeeper between the data and the outside world and only permits authorized users to access or transmit data. In 2013, the Massachusetts Supreme Court ruled that ZIP codes are PII.

27. Privacy Issues in the Cloud By moving your data to a cloud server, you are giving custody of data to the cloud provider. Need to understand how the cloud provider will: – Protect your data – Prevent theft or breach – Report to you in the event of theft or breach – Allow your clients to audit the provider – Pass through your privacy policy or require you to pass through theirs Where in the world is your data?

28. Reduce Your Privacy Risk Security procedures and standards Understand jurisdiction locations Immediate notice of any security breach Specific protocols to access data

29. “ Big Data” Data is not Intellectual Property Trespass

30. DATA IS NOT IP … Yet Feist v. Rural Telephone Service Co (499 U.S. 340, 111 S. Ct. 1282, 113 L. Ed. 2d 358,1991 U.S.) (499 U.S. 340, 111 S. Ct. 1282, 113 L. Ed. 2d 358,1991 U.S. Facts cannot be copyrighted, however compilations of facts can generally be copyrighted. To qualify for copyright protection, a work must be original to the author, which means that the work was independently created by the author, and it possesses at least some minimal degree of creativity. A work may be original even thought it closely resembles other works so long as the similarity is fortuitous, not the result of copying. Facts are not original. The first person to find and report a particular fact has not created the fact; he has merely discovered its existence. Facts may not be copyrighted and are part of the public domain available to every person. Factual compilations may possess the requisite originality. The author chooses what facts to include, in what order to place them, and how to arrange the collected date so they may be effectively used by readers. Thus, even a directory that contains no written expression that could be protected, only facts, meets the constitutional minimum for copyright protection if it features an original selection or arrangement. But, even though the format is original, the facts themselves do not become original through association. The copyright on a factual compilation is limited to formatting. The copyright does not extend to the facts themselves. (http://www.casebriefs.com/blog/law/property/property-law-keyed-to-singer/intellectual- property/feist-v-rural-telephone-service-co/)

31. Legal Issues Raised by Automated Data Gathering/Protecting Your Data Copyright Infringement Trespass/Breach of Applicable Terms of Service Computer Fraud and Abuse Act and other Criminal Statutes

32. Other Cloud Issues Other Cloud Issues To Consider

33. Other Cloud Issues Vendor management – Cloud agreements are nothing like classic outsourcing agreements of old. But the potential impact of the cloud vendor is the same. What levers do you have to fix a problem with your cloud provider? Pricing and business models – the cloud smoothes cash flow and reduces cost, but increases business risk. How do you account for those risks in the services you resell and in your business model?

34. Other Cloud Issues Availability and interoperability – The cloud is great, but inflexible. Whether you are providing a cloud service or using one, have you dealt with all of the complexities around your interfaces and your obligations to maintain them/rights in them? As standards evolve in this area, how do you know you are building to the right one, and/or that you can mix and match?

35. Other Cloud Issues Accounting - Cloud services often change the fundamental nature of the way you consume and/or sell services. How does that impact your accounting systems? Cross-border Issues – In taxation and privacy certainly, and possibly in areas like export of technology, you may be subjecting yourself to jurisdiction of government entities of which you are only marginally aware? How do you mitigate that risk?

36. Open Source Issues and Opportunities MCLE New England 2pm-5pm on January 28, 2016 David G. Rickerby

37. Overview Introduction to Open Source Enforced Sharing Managing Open Source

38. What is Open Source? “Open” “Source” – Any software licensing model that makes the source available to copy, distribute, modify, etc.

39. Why isn’t open source just like a commercial license? In many ways they are the same: Both commercial and open source licenses are based on ownership of intellectual property. Both grant certain rights and retain others. Both are governed by the same laws. Both may include provisions which may be incompatible with the other type of license, and, indeed with other licenses of the same type.

40. But… Open Source Licenses: Tend to have different goals Are usually written by and for developers not lawyers Encourage uncontrolled combination and reuse of the IP Form a contract in a different way than most commercial licenses (in fact some argue they don’t form a contract at all – merely act as a permission) AND Some open source licenses impose sharing obligations on users

41. Two Basic Schools of Open Source FOSS (Free and Open Source Software) – Requires licensor to make improvements or enhancements available under similar terms – Primary example is the GPL: Licensee must distribute “work based on the program” and cause such works to be licensed … under the terms of the GPL Academic/Permissive – Modifications/enhancements may remain proprietary – Distribution in source code or object code permitted provided copyright notice & liability disclaimer are included and contributors’ names are not used to endorse products – Primary examples: Berkeley Software Distribution (BSD), Apache Software License

42. OSI Approved Licenses (www.opensource.org )www.opensource.org 74 Current Approved Licenses 1.Academic Free License 3.0 (AFL-3.0) 2.Affero General Public License 3.0 (AGPL-3.0) 3.Adaptive Public License (APL-1.0) 4.Apache License 2.0 5.Apple Public Source License 6.Artistic license 2.0 7.Attribution Assurance Licenses (AAL) 8.BSD 3-Clause "New" or "Revised" License (BSD-3- Clause) 9.BSD 2-Clause "Simplified" or "FreeBSD" License (BSD-2- Clause) 10.Boost Software License (BSL-1.0) 11.CeCILL License 2.1 (CECILL-2.1) 12.Computer Associates Trusted Open Source License 1.1 (CATOSL-1.1) 13.Common Development and Distribution License 1.0 (CDDL-1.0) 14.Common Public Attribution License 1.0 (CPAL-1.0) 15.CUA Office Public License Version 1.0 16.EU DataGrid Software License 17.Eclipse Public License 1.0 (EPL- 1.0) 18.eCos License version 2.0 19.Educational Community License, Version 2.0 (ECL-2.0) 20.Eiffel Forum License V2.0 (EFL-2.0) 21.Entessa Public License (Entessa) 22.European Union Public License, Version 1.1 (EUPL-1.1) 23.Fair License (Fair) 24.Frameworx License (Frameworx-1.0) 25.Free Public License 1.0.0 26.GNU Affero General Public License v3 (AGPL-3.0) 27.GNU General Public License version 2.0 (GPL-2.0) 28.GNU General Public License version 3.0 (GPL-3.0) 29.GNU Library or "Lesser" General Public License version 2.1 (LGPL-2.1) 30.GNU Library or "Lesser" General Public License version 3.0 (LGPL-3.0) 31.Historical Permission Notice and Disclaimer (HPND) 32.IBM Public License 1.0 (IPL-1.0) 33.IPA Font License (IPA) 34.ISC License (ISC) 35.LaTeX Project Public License 1.3c 36.Lucent Public License Version 1.02 37.MirOS Licence (MirOS) 38.Microsoft Public License (MS-PL) 39.Microsoft Reciprocal License (MS-RL) 40.MIT license (MIT) 41.Motosoto License (Motosoto) 42.Mozilla Public License 2.0 (MPL-2.0) 43.Multics License (Multics) 44.NASA Open Source Agreement 1.3 45.NTP License (NTP) 46.Naumen Public License (Naumen) 47.Nethack General Public License 48.Nokia Open Source License (Nokia) 49.Non-Profit Open Software License 3.0 50.OCLC Research Public License 2.0 51.Open Font License 1.1 (OFL-1.1) 52.Open Group Test Suite License 53.Open Software License 3.0 (OSL-3.0) 54.OSET Foundation Public License version 2.1 55.PHP License 3.0 (PHP-3.0) 56.The PostgreSQL License (PostgreSQL) 57.Python License (Python-2.0) 58.CNRI Python license (CNRI-Python) (CNRI portion of Python License) 59.Q Public License (QPL-1.0) 60.RealNetworks Public Source License V1.0 (RPSL-1.0) 61.Reciprocal Public License 1.5 62.Ricoh Source Code Public License 63.Simple Public License 2.0 (SimPL-2.0) 64.Sleepycat License (Sleepycat) 65.Sun Public License 1.0 (SPL-1.0) 66.Sybase Open Watcom Public License 1.0 (Watcom-1.0) 67.University of Illinois/NCSA Open Source License (NCSA) 68.Universal Permissive License (UPL) 69.Vovida Software License v. 1.0 70.W3C License (W3C) 71.wxWindows Library License (WXwindows) 72.X.Net License (Xnet) 73.Zope Public License 2.0 (ZPL-2.0) 74.zlib/libpng license (Zlib)

43. 10 Most Common Open Source Licenses Note: The table above lists the top licenses that are used in open source projects ranked by number of projects using the license, according to the Black Duck Software KnowledgeBase. This data is updated daily. This data was pulled on November 17, 2015. Visit: http://osrc.blackducksoftware.com/data/licenses/ for more information.http://osrc.blackducksoftware.com/data/licenses/ 1.MIT License24% 2.GNU General Public License (GPL) 2.023% 3.Apache License 2.016% 4.GNU General Public License (GPL) 3.09% 5.BSD License 2.0 (3-clause, New or Revised) License6% 6.GNU Lesser General Public License (LGPL) 2.15% 7.Artistic License (Perl)4% 8.GNU Lesser General Public License (LGPL) 3.02% 9.Microsoft Public License2% 10.Eclipse Public License (EPL)2%

44. An oversimplified summary: FOSS Licenses (GPL2, GPL3, Affero GPL, LGPL) are going to require you to make the source code available under the same license for the open source program and for any work you distribute which is based on the program. Many other Open Source licenses (Mozilla, CPL) are going to require you to make available modifications you make to the open source program, but not works which interface with it. A few open source licenses (Apache, BSD) are going to let you do pretty much whatever you want with the code as long as you give appropriate credit and disclaim all warranties and liability (there is no such thing as a free lunch).

45. Enforced Sharing: GPL v2 “[T]he intent is to exercise the right to control the distribution of derivative or collective works based on the Program.” “You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.” http://www.gnu.org/licenses/gpl.html

46. Enforced Sharing: LGPL 5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. http://www.gnu.org/licenses/lgpl.html

47. Enforced Sharing: LGPL http://www.gnu.org/licenses/lgpl.html 6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications. You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things: a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work … b) Use a suitable shared library mechanism for linking with the Library. … c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. …

48. Enforced Sharing: GPL v3 You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License… A “covered work” means either the unmodified Program or a work based on the Program. To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

49. Keys to Open Source The key to any open source analysis is the same: – Know and understand the facts – Read the license – Know the norms of the community from which you are taking the source – Play nice

50. Focus is Compliance Companies are adopting open source policies and processes: – To alleviate litigation concerns – As an important M&A Issue – To comply with Customer diligence – More participation in open source communities: what are your employees contributing?

51. Elements for an Open Source Program? Published Policy Open Source Process Owner Approval Processes Monitoring & Tracking Process Obligation Verification Process And… As much as I’d like to sell you my services, this is OPEN SOURCE, so check out http://www.linuxfoundation.org/programs/leg al/compliance for sample policies. http://www.linuxfoundation.org/programs/leg al/compliance

52. Be Ready to Comply with the Letter of the Requirements Free Software Foundation’s compliance guide - http://copyleft.org/guide/comprehensive-gpl- guidepa2.html – Monitor Software Acquisitions – ignorance is not an excuse. – Track you changes and releases – you need to be able to provide the exact code that is shipping. – Don’t have a “Build Guru” – users need to be able to successfully build your code. You need to provide the scripts and other materials that are necessary to build and install.

53. Common Mistakes Legalese: make it understandable Specific policy that ignores other issues Policy too strict so VOA: Violated on Arrival Does not allow for edge cases Does not provide for modification to meet changes in business model/products

54. Summary Treat the management of open source software as an integrated, cross-functional business process Establish policies, define the process and process owners Phase the deployment to yield near-term results Technology platforms can automate the process, enhance cross-functional collaboration and ensure validation

55. Questions? David Rickerby, Esq. David@bostontechlaw.com 617-848-2616