Cloud Computing: The Legal Side and Much More

As parts of the world emerge from the pandemic, and having had our reliance on technology confirmed by 18 months of mass remote working and learning, it is timely to consider the changes brought about by the acceleration in the mass adoption of cloud computing technologies and what we see on the horizon.

It has been clear from marketplace surveys globally that cloud technologies have helped organisations respond to covid-19 by facilitating the transition to remote working, allowing agility and scalability and enabling ‘business as usual’ during the course of the pandemic.

The growth statistics in this market are eye-watering. Whilst in 2018, public cloud services, including infrastructure as a service (IaaS), platforms as a service (PaaS), software as a service (SaaS) and management services, accounted for less than 1 per cent ($182.4 billion) of the overall $3.7 trillion IT infrastructure spending worldwide, Gartner predicts that the market size of the industry will increase at nearly three times the rate of overall IT services in 2022, to reach $331 billion. June 2021 data from Gartner suggests global spending on public cloud IaaS grew almost 41 per cent in 2020 and is now worth $64.3bn.

Amazon Web Services (AWS) is the largest IaaS provider (with approximately 40 per cent market share), followed by Microsoft, Alibaba, Google and Huawei, with Gartner noting that these five organisations account for 80 per cent of the IaaS market.

The impact of the pandemic (and the associated need to migrate critical workload to the cloud) is likely to have driven the significant market growth in 2020/2021.

Anecdotally, industry figures suggest that covid-related digital transformation has accelerated adoption of cloud by three to five years. IBM’s most recent?cloud marketplace survey?suggests the pressures of the pandemic have accelerated the need for cloud infrastructure, professional skills development, and security upgrades.

More than 60 per cent of IBM’s respondents said they expect increased demand for cloud infrastructure to be permanent.

Key drivers of the migration to cloud appear to be the need for increased infrastructure flexibility, the need for competitive advantage, cost savings, increasing globalization and meeting of client demands.

A comparison of the leading cloud providers showing relative market share by geography can be found?on Future Processing’s Business Blog.?

Information Services Group believes cloud-based IT services will soon account for more than half of IT service spending in Europe, as the recovery from the covid-19 pandemic continues.

It estimates that these services accounted for 46 per cent of total IT and business service outsourcing in Europe during Q2 2021, with organisations in the Europe, Middle East and Africa (EMEA) region spending ￡4.5bn in the past three months on IT and business services, which was 33 per cent more than the same period last year when the pandemic stalled the global economy.

With this exponential growth in market size and customer demand, comes increasing regulatory oversight. This is likely to be a recurring theme globally. With changes in the US administration seeing a prominent critic of Big Tech, Lina Khan, being appointed head of the US Federal Trade Commission (FTC), the European Commission launching investigations at the intersection of privacy and competition and the United Kingdom now regulating and enforcing in its own capacity, this year and next could be turbulent for the larger tech companies.

Although, at present, there are no investigations open into the market power of the large cloud service providers, with AWS reportedly controlling as much as 45 per cent of the IaaS market, moves are afoot to look more closely at this sector. And the European Union’s Data Protection Supervisor has?opened investigations?into the European Parliament’s and European Commission’s use of Microsoft and AWS cloud technologies, amid concerns that use of the services may not comply with EU data protection law, following the European Court of Justice’s decision in?Schrems II?(which affected the transfer of data between the European Union and the United States).

Issues such as contract pricing, self-preferencing and lock-in are likely to be at the forefront of regulatory focus. And in October 2020, the US House Judiciary Committee included cloud computing in its report?Investigation of Competition in Digital Markets?that examined issues of conflict and the impact of dominant incumbent platforms affecting innovation and market entry of new businesses. Market leaders in cloud computing benefitted from early-mover advantage, coupled with network effects and high switching costs that can lock in customers.

The US report also highlighted specific techniques used to deter switching by customers, such as long-term contracts, free tier products (which tend to deter switching to a new provider at the end of a free trial period, due to the investment of time and resources required to adapt to a new provider, as well as the requirement to pay exit fees to the original provider).

Exit fees can create significant financial barriers to migrating away from specific providers, coupled with technical design challenges to adapt to the new cloud service provider’s method of operating its services. Portability, exit costs and interoperability are therefore likely to be at the forefront of regulatory concern.

We’ve also seen central banks express concern about the systemic risk posed to financial markets by the highly concentrated nature of the cloud provider market. The Bank of England has indicated that greater direct regulatory oversight will be required of the large cloud computing providers, as the bank balances the need to roll back some of the secrecy associated with use of outsourced system provision, so regulators can understand the risk and resilience of the systems, while not exposing providers to increased cyber risks. The Bank of England’s governor, Andrew Bailey, also noted that ‘concentrated power on terms can manifest itself in the form of secrecy, opacity, not providing customers with the sort of information they need to monitor the risk in the service’.

Hints have also been given in the Bank’s?Financial Policy Summary and Record for July 2021?that additional policy measures are likely to be required, given that without a cross‐sectoral regulatory framework, and cross‐border co‐operation where appropriate, there are limits to the extent to which financial regulators alone can mitigate these risks effectively.

Critics of the UK government have also expressed concern about the number and value of cloud computing contracts awarded to Amazon (which is believed to have won around ￡75 million worth of contracts for web hosting, software and support services in 2020), creating a significant dependency on a single provider.

Increased reliance on cloud technologies (and a small number of significant market players) also exposes the systemic risk posed to businesses where a cloud service provider suffers an outage (illustrated in early June 2021 by the software bug affecting?Fastly’s operations?that led to a significant number of popular websites being inaccessible for about an hour) or is the victim of a cyberattack that affects its service offering.

Recently, the United Kingdom’s?National Cyber Security Centre has repeated warnings?that the expansion in use of cloud services to support working outside of the usual corporate networks due to the coronavirus pandemic, has given cyber criminals an increased attack surface.

Unpatched vulnerabilities and unsecured networks can be exploited by malicious users for identity and data theft, and ransomware attacks or other malware activities.

Both in-house skills shortages and budgetary constraints will impact the ongoing pivot to cloud, as businesses continue to be buffeted by pandemic-related economic headwinds and evaluate their future cloud strategies and cloud transition plans.