Canadian Lawyer InHouse

april 2014 26 INHOUSE more inclined to look at owning and design- ing and maintaining one." In-house lawyers that get involved in arrangements to build or run a stand-alone facility may need to quickly get up to speed on some fairly arcane technical issues. This includes what type of power, or comput- ing densities, the organization requires. IT infrastructure tends to be measured in met- rics of watts per square foot, McMullen ex- plains, and as more complex functions hap- pen in data centres, the density is on the rise. For example, old or "legacy" servers might have been designed at two to three kilowatts per "rack" (the space on which a server sits in a data centre). Modern data centres, on the other hand, may need to be designed at 20- 25 kW per rack, which would require some specifi c provisions in utility agreements. "It enhances computing capacity, but it also impacts the mechanical and electrical ability you need to support that," he says. Then there's site selection. McMullen says organizations need to understand what attributes a physical area has had historically before they even begin to put hardware and software inside. He remembers specifi cally a project involving a bank in the Caribbean. "They were building a data centre and one of the aspects they had to determine is seismic. It turned out they were going to be on the same fault line as Haiti," he says. "We went back close to 200 years of history to de- termine whether or not we should build the data centre because of the seismic activity." Other check marks on the due diligence list include fl ight paths, toxic areas, railway paths, and so on. This has a bearing on what kind of resiliency a data centre needs to have, because in many cases today, when servers go down, businesses stop functioning. For many mid-sized Canadian companies, this may not seem worth the effort or legal liability, but leasing facilities comes with its own set of dangers, says Derek McCallum, partner and member of the real estate group at Aird & Berlis LLP in Toronto. While leasing obviously allows fi rms to spread the costs of owning and managing a data centre out over a period of time, it is impor- tant agreements bake in enough protection if the unexpected happens. "If the landlord is not carrying out its re- pair obligations, the idea of suing them may be way too lengthy," he says as an example. "You may need a lease that says, 'I can do it and offset it against my rent.' You need to be able to keep the facility up 24/7." Besides making sure a leased facility has dual power feeds in the event of a blackout and other disaster recovery capabilities, McCallum suggests agreements be long enough that a company can plan a smooth exit strategy. "The amount of time to do a migration from one facility to another is way beyond turning off a switch in one place and fl ipping on a switch elsewhere," he says, citing some situations that can take more than a year to complete. "With those kinds of time frames in mind, leases become long term. The issue from a tenant's perspective is having it done with a whole series of renewals that are fi ve-year terms." The colocation model — where a com- pany houses its servers in a third-party site along with other fi rms' servers — is a popu- lar approach for mid-market companies that are realizing they don't want the leasing hassles, says Ghan. "The problem with this industry is once you lease a data centre and once it's full of client hardware, it's really hard to get out," he says. "You can't just move them off. You wind up experiencing downtime, and noth- ing turns customers off more than that." The downside of colocation, however, is it's sort of like the difference between owning your home or living in a hotel. "Everybody and their brother has stuff there," McCallum says. "If it's one of those hub buildings, you need to accept a certain level of risk. Otherwise there should be some exclusivity provisions in there, that your in- frastructure isn't next to a competitor's, or that it's a certain distance from a competitor." Managed services add a bit more fl exibil- ity and protection, and may be the way more risk-averse fi rms balance the need for in- creased compute power with reduced costs. An example is Toronto-based SecureKey Technologies Inc., which provides identify management software to large corporations and governments. Richard Guttman, Secu- reKey's vice president and general counsel, says the company's software-as-a-service offering was a natural candidate for a com- pany that could provide trustworthy third- party services. In Canada, it has been using Q9 Networks, while its recent contract with a U.S. federal agency led to an agreement with Hewlett-Packard Co. In general, Guttman fi nds service providers able to meet requirements, but complications con- tinue to rear their heads occasionally. "Where we struggle is when you buy more standardized offerings (from a servic- es provider) and then your customers then ask for things like audit rights and security and penetration testing," he says. For the service providers, "What we do in our cages is none of their business, and they're not in the business of giving access. You lose the ability in contractual negotiations to offer things that otherwise would seem logical." Also, as a relatively young company and whose software is its main asset, SecureKey tends to undergo a lot of technology change. "There have been numerous requests that have required us to go back and make some modifi cations with Q9, where we've added a number of additional services, or we've '' '' if it's one of those hub buildings, you need to accept a certain level of risk. otherwise there should be some exclusivity provisions in there, that your infrastructure isn't next to a competitor's, or that it's a certain distance from a competitor. dereK mccallum, aird & berlis llp

• Cover