Caught in the Cloud: How Hard Could It Be To Recover Your Data From A Defunct Cloud Provider?

So you store your data in the cloud.  Imagine your cloud provider were to run afoul of the government for copyright violations.  How long would you expect it to take to get your data back?  What if it took more than a year?  What hoops would you have to jump through along the way?  A civil dispute playing out within a criminal proceeding in the U.S. District Court for the Eastern District of Virginia provides some important warnings.

In January 2012, the U.S. Justice Department shut down the popular file-sharing website Megaupload.com, alleging violations of copyright and money laundering laws.  Because the site was easy to use and inexpensive, individuals and small businesses also used the site for data storage and sharing of large files.  When the government indicted Megaupload.com’s executives, it seized data stored on servers owned by Carpathia Hosting, Inc., including high school sports videos owned by videographer Kyle Goodwin, the operator of Ohio SportsNet. 

Goodwin filed a motion asking the Court to return his sports video files pursuant to Rule 41(g) of the Federal Rules of Criminal Procedure.  Goodwin claims he loaded the videos to the site to backup his work, that he never used the site for piracy, and that Megaupload.com has the only remaining copy of his videos because his hard drive crashed shortly before the raid. The government is contesting Goodwin’s claim, and more than a year later the issue is still unresolved. 

The government’s arguments for withholding the data provide important cautions for any business considering contract terms for cloud computing.  The government has argued in its briefs:

• “[T]he mere fact that [Goodwin] may claim . . . an initial copyright to a version of the files he uploaded is not sufficient to establish that he has an ownership interest in the subject of his motion—the copies of his data, if any, which remain on Carpathia’s servers.” 
• Goodwin’s contract rights may already provide him with an adequate remedy (i.e., money damages).
• The cost and technical feasibility of finding a single user’s data such as Goodwin’s on the Carpathia servers should excuse the government from turning over the data.  In other words, the cost and burden of finding the data should preclude recovery. 

The Court has yet to rule on Goodwin’s motion, but look for the decision to shed some light on the developing law regarding data security and ownership in the cloud.