IDG News Service — Cloud computing vendors need to band together to create rules on privacy and security or face the prospect of having the U.S. Congress pass regulations, Microsoft (MSFT) General Counsel Brad Smith said Wednesday.

Cloud Computing Definitions and Solutions

During a speech at the Brookings Institution, a Washington, D.C., think tank, Smith called for new "truth-in-cloud-computing" principles that would let consumers and businesses know how their information will be accessed by service providers and how it will be stored online.

"These principles should ensure that there is transparency over how data is protected," he said. "Simply put, it should not be enough for service providers simply to say that their services are private and secure," Smith added. "There needs to be some transparency about why this is the case."

Cloud providers should maintain a comprehensive security program and should disclose whether their security efforts meet security standards, Smith said. Customers should know how they can reclaim their documents and data, he added.

Cloud computing vendors could create a self-regulatory code, or they could face regulation from Congress, Smith said. Action from Congress is "likely," he said. If regulation happens, Microsoft would prefer it on the national, rather than state level, he said.

"Simply put, it should not be enough for service providers simply to say that their services are private and secure," Smith added. "There needs to be some transparency about why this is the case."

Smith also called for the U.S. government to work with other nations on an agreement that would allow cloud providers to operate without having to comply with laws in every country they have customers. The U.S. and other countries should establish a multilateral "free trade zone" for data packets, he said.

A handful of other governments have already tried to gain access to data stored in the U.S., he said.

"Where different laws conflict, a decision to comply with a lawful demand for user data in one jurisdiction may place a provider at risk of violating laws elsewhere," he said. "This also makes it more difficult to provide consumers with accurate information about when and how their personal information might be accessed by law enforcement."

Microsoft also supports efforts to update privacy protection laws to deal with online activities, and it wants changes to computer crime laws that would make it easier for prosecutors to charge cybercriminals, Smith said. In some cases, it's difficult for prosecutors now to place monetary values on stolen documents, e-mail or digital photos, he said.

Continue Reading