Oct 31 2007
More ISPCON Notes: David Snead Brings SaaS Doom and Gloom
Probably the last of my notes from ISPCON fall 2007 here. Playing a little catch-up, but I’m just about caught up at this point.
One of the most interesting things I witnessed at ISPCON was (WHIR blogger and columnist) David Snead’s 8:45 a.m. Wednesday presentation “Negotiating the SaaS Minefield.”
We’ve mostly all been exposed to the SaaS hype, I’d imagine, by this point. It seems like the issue about which hosting providers and their suppliers are most uniformly excited. That is, except for David Snead, who sometimes seems like the lone dissenting voice in the chorus of folks talking up the technology.
It’s not that he’s saying “SaaS is bad.” It’s really more like “hey, wait a second now.” But it’s unique enough to make his opinion especially noticeable, especially in the format of a conference agenda, where much of the material is outright promotional.
David’s particular message regarding SaaS is nothing new to the WHIR – he’s been providing us with content on the subject for quite some time. And needless to say, I’ve read everything David’s written for the WHIR. But that (perhaps surprisingly) took nothing away from his presentation, which was a very informative and engaging lesson in liability as it could apply to a Web host’s SaaS efforts.
In fact, I don’t think I saw as many questions in any other session, and it wasn’t exactly a packed house for this pre-9:00 a.m. event.
His premise: Web hosting itself is technically a “hosted service.” But for the sort of simple “ping, power and pipe” configuration that some hosts provide, it is very easy to do a risk assessment.
Foundational to the discussion is the Communications Decency Act, which, while partially overturned, continues to dictate that if you provide computer access by multiple users, you’re not liable for the data you process, because you do not manipulate the data. Therefore a dial-up provider, for instance, has no liability should a customer watch a copyright infringing YouTube clip.
When you begin to work in SaaS, you begin to manipulate data, and accrue liability. A risk assessment becomes more difficult.
Adding complexity to services adds liability to those relationships. And that liability should be negotiated in the service contracts, both between service providers and their customers and between service providers and their vendors.
Terms of service contracts in the typical hosting model are virtually standardized. That is, companies are comfortable enough in their risk assessments that they’re willing to use standardized terms of service (sometimes borrowing existing ones, often from Rackspace, in David’s experience).
In the SaaS model, nothing is standardized, and companies may be taking on more liability than they realize in offering these services. More complex contracts are required.
One specific piece of advice he offered was that SaaS application providers should have written contracts that actually have customers indicate their written consent.
The expanding of context goes upwards, too. Renegotiating vendor deals is critical too. It’s key, he says, that your vendors have “skin in the game.” Don’t accept their first offer of accountability, and make sure they provide SLAs with compensation when they’re not met, and indemnify you when their products don’t work.
Most of this work is, obviously, something you’re going to need a legal advisor to do for you: drafting your terms of service, negotiating your vendor contracts.
Another thing that can help protect your business against failures in outsourced services is insurance. Your insurance company has special considerations for Internet businesses, but it may not be aware you’re in the Internet business. Make sure that’s the case.
So the title may have been ever so slightly misleading. David Snead’s SaaS message isn’t all “doom and gloom.” But he is acutely aware of the fact that service providers don’t always consider all the legal repercussions of incorporating solutions into their services.
Really, he’s all positivity.
