Login | May 03, 2025
FTC wants to know about cloud cybersecurity
RICHARD WEINER
Technology for Lawyers
Published: April 7, 2023
The Federal Trade Commission is sending out questionnaires to cloud providers about their cybersecurity. The agency is also seeking public comment on the issue.
No, that’s not a headline from 10 years ago.
As reported by govinfosecurity.com, "Large parts of the economy now rely on cloud computing services for a range of services," said FTC Chief Technology Officer Stephanie Nguyen. In fact, according to research firm Canalys, spending on cloud computing reached around $250 billion in 2022.
And all of that cloud computing is offered by a small number of companies. Two-thirds of cloud computing is run by three companies: AWS (Amazon), Microsoft Azure, and Google Cloud. Surprise! The cloud business has been being consolidated over the last decade, and has seen some spectacular failures in which thousands/millions of people have been hacked or lost their data.
Another 2022 study by the French company Thales of 3000 companies found that data security breaches in the cloud happen often enough to be a common problem. Beyond that, half of the respondents said that managing data security in the cloud was actually more complex than managing it in-house.
And now the FTC finally wants to see what’s up. OK.
The agency sent out a request for information asking cloud providers if they use contractual or technological measures to entrench customers. The request also asks for public input on several questions, including what representations cloud companies make to customers about their cybersecurity.
Additionally (and this is important), the FTC wants to know what contractual divisions the companies make regarding data security between the providers and the customers—something that has been a concern since the very beginning of cloud computing. Who is responsible for data security, and to what extent? This is a question that every cloud computing customer, including law firms, needs to set up before and data is transferred.
Analysts see a play here by the FTC—to see if the industry is so dominated by a few players that they could be regulated as a public utility.
So this could be a lot of fun. If you want to play this particular game, you have until May 22 to comment.