Weather comes and goes but the cloud is forever. That was more or less the major takeaway from the Legalweek 2019 panel titled "The International Legal Cloud 2019: Discovery Security and Business Considerations,"—which is really just a long-winded way of asking how lawyers are feeling about the cloud.

The short answer is lukewarm, but getting warmer thanks to encryption standards and the aforementioned inevitability of the whole deal.

"It's not a case of if you go to the cloud, it's when you go to the cloud," said Mark Anderson, a panelist and senior project consultant with Complete Discovery Source.

Based on the feedback that he's received from clients, lawyers are more interested in weighing the benefits of the technology than the risks.

On the benefits side, there's ease of access for clients and attorneys alike and the ability to travel internationally without a laptop full of sensitive information along for the ride. The risks are breach-related, constituting everything from a failure to protect a client's privileged data to running afoul the European Union's General Data Protection Regulation (GDPR).

In some cases, attorneys are weighing the scales while already making daily use of the cloud in their business practices—albeit unwittingly.

"Then you're talking to them they're actually using the cloud for their email systems and they don't even know it," Anderson said.

His fellow panelist Dera Nevin, a senior associate with Baker McKenzie, often asks lawyers where they think their email is stored only to have them point to a computer. The realization of how closely the cloud has already integrated into their personal lives can alleviate fears to a degree, but some are still hesitant to upload clients' trade secrets.

Nevin emphasized that lawyers with concerns regarding the security of the cloud have the background and training to negotiate terms with service providers. There are a couple of items that should crop up early in the discussions.

"It's very important to understand who actually owns the data," Nevin said.

The type of encryption that is being deployed while the data is in transit or at rest is also a big-ticket item. Some lawyers aren't comfortable with the service provider having access to the data and are insistent upon a private encryption key. Beyond the usual safety provisions, Nevin said that updating retention requirements to reflect GDPR mandates has become a major part of her practice.

Panelist Heidi Stenberg, who is a principal in the fraud investigation and dispute services practice of Ernst & Young, thinks that companies will continue to invest in the direction of the cloud.

As that happens, it will be important for organizations to maintain a data map to easily trace the location of a piece of stored information. "Having that evergreen and keeping that up to date is very important," Stenberg said.