Privacy in the cloud: Going beyond the contractarian paradigm

Human life today has become entangled in the Internet. We access e-mail, store content, and use services online without a thought as to where data reside or how data are protected. The "cloud," a conceptualization of how data reside on the Internet rather than locally, is the latest technological innovation or computing trend du jour. However, many concerns surrounding cloud computing remain unaddressed. How are the data we store online kept confidential? Who else has the right to access our private information? What kind of laws and policies offer us protection? We begin by evaluating the current situation by examining the Terms of Service (ToS) agreements and privacy policies from well-known cloud providers, and we describe the types of privacy protections (or lack thereof) that they offer. We conclude that a contractarian approach to privacy protection is likely to lead to a situation in which consumers end up trading their privacy without being well-informed about the implications and consequences of their choices. Next, we examine whether the applicable laws are adequate to protect the privacy of consumers in the cloud. We discuss privacy protections in the cloud by considering the Fourth Amendment, the Stored Communications Act, the Federal Information Security Management Act, and the USA PATRIOT Act, and we conclude that they are inadequate in according a minimum level of privacy to consumers in the cloud, setting the stage for a vigorous study of the form and substance of cloud computing-centric privacy legislation.