With the intense scrutiny and speculation swirling around WikiLeaks’ most recent posting of confidential U.S. State Department documents, it should not come as a surprise that Amazon, WikiLeaks’ hosting provider, found itself under informal investigation by Congress. Facing this type of inquiry, it did not take long for Amazon to terminate its cloud agreement with WikiLeaks, leaving the whistle-blowing site temporarily without an online presence as it searched for a new cloud provider to host its materials.
While this action by Amazon is arguably the right decision from a national security perspective, it raises some general concerns regarding cloud computing, specifically: How much power do cloud providers wield over your company’s business continuity? Cloud contracts generally include language allowing for the provider to terminate the agreement for cause, citing illegal or improper use of its platform. However, problems arise for cloud customers when these contracts give the cloud provider complete and sole discretion over what constitutes improper use. Based on the Acceptable Use Policy incorporated into Amazon’s Web Services agreement, this provision is likely what Amazon pointed to in justifying its action to terminate its agreement with WikiLeaks.
Such unfettered control by the cloud provider is a risk that companies working in the cloud clearly should not accept, if at all possible. Most companies do not engage in the types of activities at issue in the WikiLeaks affair, but less egregious activity easily can be justified by the provider under these broad termination provisions, leaving the cloud customer scrambling to keep its business operational while it seeks alternatives. Companies should carefully review and negotiate the acceptable use policies attached to contracts to retain some control over the termination provisions before moving business-critical activities to the cloud.