Know the potential problems
And yet most companies are blissfully unaware of the potential problems with e-discovery, says Murphy. In a recent survey of legal and IT professionals using cloud services, Murphy found that less than 16 percent of 172 respondents had put an e-discovery plan in place before moving data to the cloud. Even more alarming, he says, nearly 60 percent of respondents didn't know whether they had an e-discovery plan in place or not.
In another survey, conducted last year by Clearwell Systems Inc. (an e-discovery vendor acquired last year by Symantec) and consulting firm Enterprise Strategy Group (ESG) Inc., nearly 60 percent of more than 100 Fortune 2000 enterprises and government agencies said they expected to have to consider their cloud-based applications "in scope" for e-discovery.
In the same survey, however, only 26 percent considered themselves somewhat or very prepared for such e-discovery requests. In other words, notes Katey Wood, an ESG analyst, "they said yes, they think they'll have litigation, but no, they are not prepared for it."
Murphy thinks lawyers may even start to target cloud-based sources of information hoping to catch opponents unprepared. A wily opposing attorney could, for example, request discovery of data in Salesforce.com, knowing that most companies are inexperienced with doing collections from that particular data source.
"Until we have a successful anecdote in which someone gets sued and they run their search successfully on data in the cloud, until they've actually done it at speed and to scale, we won't really know" how prepared companies are for e-discovery in the cloud, he says.
Tom Conophy, CIO of InterContinental Hotels Group, is one executive who believes he's got his bases covered. Among the many cloud initiatives of the $18 billion hospitality company is a project to move its global reservations system, now on a mainframe, to the cloud.
IHG is in the process of choosing a cloud provider and in its contracts, the company is "very careful about making sure that our intellectual property and our content is ours, and that at any given time we have the ability to access it, export it, turn it off -- whatever we need to do with it," says Conophy. "It's no different than if it was running in our own [data center]."
Be mindful of email, social media
Potential e-discovery problems vary depending on the type of cloud provider and the contract, observers say. Because email has been subject to e-discovery for a while, many email hosting providers have this covered in their contracts. And large cloud vendors that typically serve Fortune 500 companies are likely to pay more attention to the discoverability of data.
With other cloud providers, the area can be murky. "A lot is negotiated on a vendor-by-vendor basis at this point," says Wood. (For guidance, see E-discovery questions to ask your cloud vendor] and 20 steps to an iron-clad SaaS contract.)
Some SaaS providers make it easier than others to get data out of their systems. Salesforce.com, for example, "is not an easily searchable system -- because it's not a content management system per se -- and yet people are storing information there," says Murphy.