LENGTH: 2017 words

HEADLINE: Avoid Internet Outsourcing Legal Difficulties

A well-written contract cannot do the job on its own

BYLINE: By Jonathan Bick

BODY: Internet Law

The author is an adjunct professor of Internet law at Pace Law School and Rutgers Law School. He is also the author of 101 Things You Need To Know About Internet Law (Random House 2000).

Most individuals and enterprises have outsourced the equipment, software and service that maintain their Internet sites. Such outsourcing has led to new legal difficulties between Internet users of all kinds and data centers, which provide managed services. These legal difficulties could easily be avoided by implementing precautionary programs.

Five steps have proven to be equally applicable to individual and large enterprises for preventing these legal difficulties: (1) using contracts to aligned costs and service expectations; (2) implementing a separate agreement to address ongoing performance; (3) applying traditional outsourcing considerations to Internet outsourcing agreements; (4) ensuring that Internet outsourcing agreements address Internet specific laws; and (5) implementing a due diligence program. Individuals normally turn to outsourcing due to lack of technical expertise and the lower costs associated with sharing computer equipment. Individuals typically use Internet outsourcing for hosting Web sites. Economic pressures are also encouraging large corporations to outsource the running of their Internet sites. According to the Yankee Group, a market research firm based in Boston, Internet outsourcing provider revenue is expected to grow from $4 billion in 2000 to $36 billion in 2005.

Businesses use Internet outsourcers' data centers to store computer servers and equipment and to connect them to the Internet. Internet outsourcers for business typically perform project management and marketing functions for Internet sites and online projects.

The largest enterprises use Internet outsourcing firms to provide management and data storage services for both their e-businesses and traditional lines of business. This is called managed services and encompasses the outsourcing of Internet hosting, data storage and other information-technology services to a data center. It is also the most lucrative and most susceptible to the applications of the five programs noted above.

Internet outsourcing growth is occurring both inside and outside the United States, as evidenced by continued investment in this area. In July, WorldCom, the country's second- largest long-distance telephone provider, opened a $20 million, 110,000-square-foot center to host and manage Internet-related services. This facility allows businesses to make high-speed connections to the Internet, voice and data networks.

It also allows businesses to store their equipment at the centers, or allow WorldCom to manage all their e-commerce applications for them. Expand, a data-hosting service to corporations seeking to outsource the management of their Internet operations, has been funded by Singapore Telecommunications Inc. in the amount of $265 million to open Internet data centers in cities throughout Asia.

The Contract

Internet outsourcing begins with a contract. That contract must provide specific levels of defined service, availability and dedicated and defined support commitments. The contract simply ensures that buyers of outsourced Internet service have a good understanding of how service costs and service expectations are aligned. The Internet outsourcing agreement should set forth dimensions and forms of relationship governance and also set forth basic criteria for relationship maintenance such as role specification, planning, adjustment, monitoring, incentives and enforcement.

In order to offer a competitive advantage, Internet outsourcing service providers normally try to take advantage of economies of scale. To be specific, they can locate adjacent to city business districts and pay low rents. In addition, they can share the cost of backup electricity generators, 24-hour technical support and site security over a number of clients. Internet outsourcers can also located near a large source of power and use lower cost DC power.

Such actions may yield both economic benefits and legal difficulties for the user of Internet outsourcing services. The use of outsourcers in areas adjacent to city business districts may result in the user of outsourcing services having to pay additional income, sales and property taxes, as well as being subject to the law of one or more additional jurisdictions. Sharing backup electricity generators, technical support and site security can result in unintended contractual liability. The Internet outsourcers use of lower cost DC power may require the outsource service user to pay a premium for computer equipment.

The identification and resolution of each of these difficulties in an agreement before the execution of an Internet outsourcing transaction will reduce or eliminate legal difficulties.

Performance Review Process

Parties to an Internet outsourcing agreement should agree on what measures can be undertaken to ensure contractor performance and what practices will be implemented to monitor contractor performance.

A separate contract should be used to establish key performance indicators and implementation procedures that are quantifiable and measurable to monitor performance. This stand-alone agreement should have its own set of warranties and remedies.

In particular, one method of monitoring performance that has been particularly effective has been to require a specific set of data and statistics from the Internet outsourcing provider and make it available to oversight personnel within the Internet outsourcing service user via a Web-based reporting portal.

Traditional Outsourcing Considerations

Traditional outsourcing agreements break down outsourcing services into unique categories and tailor terms to address each service category separately. In the case of the Internet, outsourcing service offerings should be broken down as communicative services, informational services and transactional services.

Outsourcing services, whether traditional or Internet-related, share some characteristics that need be addressed in outsourcing contracts to reduce or avoid legal difficulties. Most important, as the level of interactivity increases, so does the risk of security breaches and the need for detailed contract controls. Thus, outsourcing Internet contracts should address such risks as compliance and reputation. Inextricably tied to risk management processes are internal controls set forth in the outsourcing contract.

As in the case of a traditional outsourcing agreement, an agreement for outsourcing Internet services must detail the policies, procedures and technology that will be employed. Specifically, Internet outsourcing contracts need to address concerns such as security, authentication, trust, nonrepudiation, privacy and availability.

The contract controls related to Internet outsourcing services should be commensurate with the level of risk presented by the services. The required contract controls will depend on the objectives of the buyer of the outsourcing service and the types of Internet services offered. It is the buyer's duty to determine the goals and objectives. Once this is established, contract controls can be developed to ensure that the goals and objectives are met.

Internet Specific Laws

Ensuring that Internet outsourcing agreements consider Internet-specific laws can also reduce legal difficulties. This is a time in contract law when pronounced legal changes to contract theory are being considered. In the United States, the Uniform Commercial Code is being redrafted. The two new articles are Article 2A (leases of personal property) and Article 4A (funds transfers). See U.C.C. 2A-101 to -532 (1993).

Numerous states and several countries have redefined the concepts of signature and writing, and have enacted new theories for determining when or whether a person is responsible in contract. The European Union is considering a Directive on Electronic Commerce that calls for EU countries to reconsider fundamentals of contract law.

Courts have also changed contract law with respect to outsourcing in general and technology related outsourcing in particular. For example, the court in Colonial Life Insurance Co. of America v. Electronic Data Systems Corp., 817 F. Supp. 235 (1993), held that a contract for outsourcing a data processing system was a sale of goods because the contract required the services provider to adapt its software to the functions of the client.

Although the court admitted that the contract had a blend of goods and services, it concluded that the essence of the transaction was for the client to license the use of the software and applied the warranty and remedy provisions of Article 2 to this dispute. Thus, Internet outsourcing contracts should be tailored to address Internet-specific laws.

One example is the need for Internet outsourcing agreements to address potential changes in traditional intellectual property rights, especially in copyright law. In particular, one clause of an Internet outsourcing agreement should address both the enactment of expanded database protection in Europe, the significant modifications that have been made in U.S. copyright law, including limited statutory recognition of "moral rights," and how the liabilities and duties of the parties will changes as those laws change.

Another clause should address the enactment of expansive protections for digital monitoring and security devices that augment copyright protection.

Due Diligence

Finally, implementation of a due diligence program is critical to help the buyer of Internet outsourcing services avoid legal difficulties. In the major outsourcing arrangements, a long-term dependence on a vendor is created. The user of Internet outsourcing services will have lost, in most instances, equipment, personnel and control. The fate of the user of the Internet outsourcing service may become the fate of the Internet outsourcing service provider.

Typically, the four elements of investigative due diligence are (1) business and media database research; (2) public records searches; (3) direct contact with government and industry sources; and (4) a detailed written disclosure and background questionnaire. These usually provide the outsourcing Internet service buyer with the critical information, problem-relationship identification and reference-checking necessary to make an informed decision.

Due to the novel nature of electronic commerce, obtaining information and interpreting it may be difficult. Consequently, buyers of outsourcing Internet services generally hire experts to determine what the due diligence results mean. In addition, these experts are called on to determine what an Internet company really does and to determine what an Internet company actually produces.

Since an outsourcing Internet service is an ongoing transaction, a due diligence program must also be ongoing. As suggested above, appropriate contractual arrangements entered into by parties to an Internet outsourcing agreement may create ongoing performance oversight; however, ensuring that the Internet outsourcing service provider has the economic wherewithal to continue to be viable should be made part of the agreement. A contract clause stating the following should be considered:

Whenever the Internet outsourcing service provider is regularly examined by a certificated public accounting firm or any subsidiary or affiliate of the Internet outsourcing service provider is subject to examination by a certified public accounting firm, the Internet outsourcing service provider shall notify the Internet outsourcing service user of the existence of the examination within 30 days after the making of such service contract or the performance of the service, whichever comes first, and provide relevant results of such an examination within 30 days of their receipt by the Internet outsourcing service provider.