Бикбулатова Ю.С_Summery (Информационно-правовое регулирование отношений, формирующихся при использовании облачных вычислений (сервисно-ориентированных распределённых информационных систем))

National Research UniversityHigher School of Economics     Bikbulatova Yuliana SergeevnaRegulation of the Cloud Computing(Service-Oriented Distributed Information Systems)PhD Dissertation Summaryfor the purpose of obtainingPhilosophy Doctor in Law HSEAcademic supervisor:Shablinsky Ilya Georgievich,Doctor of Science, professorMoscow - 2018  2  The thesis was completed at the Department of UNESCO on copyright andintellectual property law of the Faculty of Law of the National Research University‘Higher School of Economics’The text of the thesis is deposited and available on the website of the HigherSchool of Economics: https://www.hse.ru/sci/diss/12.00.13 – Information lawAcademic SecretaryDissertation Council in LawDoctor of Science, assistant professorIrina Alexandrovna Emelkina3   GENERAL OVERVIEW OF THE THESISResearch RelevanceThe advance of modern information technology affects virtually every sphereof life: the information component of human activity migrates to a virtual sphere,dramatically altering day-to-day processes.

Cloud computing1 is an organizationalmodel which brings former ideas and elements of the information system to afundamentally new level and is now among the catalysts and basic technologicalcauses of the transformation of public life.In 2017, the Russian Federation adopted a number of significant legal actsconcerning information technology with a special attention to cloud technology.The Information Society Strategy of the Russian Federation for 2017-2030 wasestablished by Presidential Decree No.20 of May 9, 20172. It points to a significantgrowth of the cloud services market (by about 40 per cent annually) and allocatescloud technology to nine key areas of Russian information and communicationrealm.

The Russian Government regulation №1632-r from July 28, 2017 ‘On theapproval of the Program “Digital Economy of the Russian Federation”’3 gives thecloud technology high priority and sets forth plans for the cloud computing inRussia. Other countries have adopted similar legal acts since 2011.Nevertheless, the cloud technology, as any other Internet-based technology,necessarily poses a risk of human and civil rights violations (for example, the rightto privacy or personal data security). The cloud technology formed the foundationof the Big Data and blockchain phenomena. There are significant potential risksand issues tied to cloud computing in deep analytics of large amounts of data and                                                            1These terms are used interchangeably: cloud technology, cloud information systems, cloud computing.Decree of the President of the Russian Federation No.

203 (May 9, 2017) "On the Strategy for the InformationSociety Development in the Russian Federation for 2017-2030" // Collection of the Russian Federation legislation.2017. No.20. Art.2901.3The Russian Government regulation №1632-r from July 28, 2017 ‘On the approval of the Program “DigitalEconomy of the Russian Federation”’// Official Internet portal of legal information. Available athttp://www.pravo.gov.ru24  blockchain-based transactions (for example, smart contracts in the Ethereum cloudinformation system).The 2017 statistics shows over eight times increase of the illegal access todata stored in clouds4 compared to 2016. In 2018, a significant number of personaldata leakages also occurred, causing huge public outcry (some of them involvednational5 government bodies as the operators).Moreover, the issues of ensuring the country’s sovereignty and the supremacyof state authority in the internal affairs become particularly crucial in the context ofthe widespread use of the Internet and cloud technology.The things are further complicated by other countries adopting extraterritorialregulations and making judicial decisions6 aimed at providing their nationalauthorities with cloud-processed data necessary for their functioning.

‘The CloudAct’ enacted by the USA on February 6, 2018 (‘Clarifying Lawful Overseas Use ofData Act’7) serves as the most striking example. The Act amends Title 18 of theUnited States Code and orders providers of electronic communication service orremote computing service registered in the United States of America to discloseupon request to public authorities the data processed by them regardless of the datalocation8.These facts indicate the need to revise national approach to the cloudtechnology regulation and develop general principles in harmony with othercountries which, at the same time, can strengthen the digital sovereignty of theRussian Federation. The global environment requires adopting legislative norms                                                            4Breach Level Index 2017 Full Report.

Available at https://www6.gemalto.com/breach-level-index-2017-fullreport?utm_campaign=breach-level-index&utm_medium=blog&utm_source=pardot5For example, on July 5, 2018, the Yandex search engine provided links to sensitive user data processed by theGoogle Docs cloud information system (e-mail and personal account passwords, personal phone numbers of largecorporations’ CEOs and their budgetary outlays). On March 28, 2018, Facebook was sued for the illegal use of 50million users’ personal data to predict voters' behavior and form a target audience opinion.6For example, the April 17, 2018 US Supreme Court decision in US v. Microsoft case recognized as unreasonablethe refusal of cloud providers to provide data stored outside the USA // US Supreme Court. United States, petitionerv.

Microsoft Corporation, 584 US No. 17-2, April 17, 2018/ Available athttps://www.supremecourt.gov/opinions/17pdf/17-2_1824.pdf7H.R.4943 - 115th Congress (2017-2018). To amend title 18, United States Code, to improve law enforcementaccess to data stored across borders, and for other purposes. Available at https://www.congress.gov/bill/115thcongress/house-bill/4943/text8Note: this regulation requires making an executive agreement by the countries’ authorities which greatly simplifiesofficial access to foreign citizens’ personal data that existed before the adoption of this document (Mutual LegalAssistance Treaties).5  which, on the one hand, promote the technology and services advancement, and,on the other hand, protect the person’s rights and legitimate interests.Based on the above, it is advisable to continue looking into the elements oflegal implications of the cloud technology and its main legal problems, and workon the development of regulatory proposals which adds to the relevance of thisthesis theme.The Degree of Scientific ElaborationDue to the novelty and lack of structuredness of the legal relationships in thedigital environment in general and the cloud technology in particular, thedistributed computing information technology have not yet become a popularsubject of legal research.

Nevertheless, it has already been elaborated on in thespheres of physics, mathematics, technics, economics and philology, as well as,indirectly, in other spheres of research tied to the cloud computing in public life(pedagogics, medicine, etc.).In 2017, a thesis on civil law relations around the use of the cloud technologywas conducted by I.A.

Nesterova where she pays special attention to the aspects ofthe legal protection of the right to the intellectual property created, used ordistributed by the cloud computing.Various aspects of the cloud technology regulation are mentioned in theworks of M.A. Bashirov, A.M. Vilinov, E.A. Voynikanis, A.I. Gazeykin, D.V.Gribanov, V.M. Gostev, A.K.

Zharova, V.O. Kalyatin, A.V. Kolyada, S.V.Makarov, I.V. Ponkin, V. Razuvaev, I. Romashevsky, A.I. Saveliev, A.G. Sergo,L. K. Tereschenko, A.A. Shatalov and E.A. Shirokova.The regulatory problems of the Internet and data processing using moderninformation technology became the subject of analysis in the works of thefollowing Russian information law experts: I.L.

Bachilo, I.Yu. Bogdanovskaya,V.A. Kopylov, V.N. Lopatin, A.A. Maksurov, T.A. Polyakova, A.A. Tedeev,Yu.A. Tikhomirov, A.A. Fatyanov, M.A. Fedotov, A.I. Khimchenko, I.G.Shablinsky and others.6  The cloud technology regulatory problems are also reflected in the works of anumber of foreign researchers: S.

Barokas, S. Bradshaw, J. Brenner, S.Kierkegaard, N. Carr, D. Koen, I. Lloyd, K. Kukie, V. Mayer-Schönberger, D.Noble, C. Millard, C. Reed, B. Franks, E. Schmidt, I. Walden and others.Furthermore, a study conducted in 2009-2013 at the University of QueenMary of London clarified the particular legal features of the cloud technologyimplementation (standardization of treaties and reservations in agreements,specifics of agreement making), as well as personal data and consumer protectionissues (Cloud Legal Project, Center for Commercial Law Studies, Queen MaryUniversity of London).However, a comprehensive study of the cloud computing regulation in theRussian Federation has never been conducted. It seems to us that the effectivenessof public regulation in this sphere largely depends on the scientific research. Thethorough study of the cloud computing legal relations is indispensable to and,ideally, should precede or adjust national lawmaking in this area leading to the bestregulatory approaches.

Therefore, the subject of this research has a great scientificand practical value.The Purpose of the ThesisThis research focuses on the comprehensive legal analysis of the relationsgenerated by the cloud technology in the Russian Federation, as well as theformulation of a conceptual and theoretical apparatus that covers the scope of theserelationships and gives approaches for the improvement of the Russian legislationon information technology.To achieve this goal, the following tasks were set:1) To define a ‘cloud technology’ concept and identify the legal implications of thecloud computing, their object and place in the information law science andlegislation;7  2) To study the features of the subject matter and determine the specifics of cloudcomputing legal relationships which directly affect the allocation of responsibilitiesamong parties;3) To study legal conflicts and risks imposed by the cloud technology includingBig Data processing;4) To identify regulatory features applicable to the personal data processing in acloud;5) To study the legislative approaches and principles adopted by other countries toregulate the cloud computing;6) To formulate principles, proposals and recommendations for the improvementof the cloud computing regulation in the Russian Federation.The object of the research is the legal relationship between parties involvedin the use of the cloud technology.The subject of the research is the law governing the relationship betweenparties involved in the use of the cloud technology in the Russian Federation andother countries, as well as academic doctrines and debates related to it.Methodology and Methods of ResearchThe research methodology combines the following scientific cognitionmethods: general (dialectics, analysis, synthesis, induction, deduction, comparativeapproach), specific (historical, formal logical, systemic), private law (legalcomparative, legal forecast, formal law) and others.The empirical basis of the study is comprised of international, Russian andforeign legal acts that regulate various aspects of the cloud technology operation.Due to the apparent novelty of the phenomenon, the legal research of therelationship between parties involved in the use of the cloud technology requiredassessment of the cloud technology implementation experience in Russia andabroad, as well as the related technical, organizational and economic models.