So what is a responsible company to do? Consider these three ethical issues:

1. Location: For both the users and providers of cloud services, it is important to have a siting strategy that fully considers the legal and jurisdictional issues where the data centers and network architecture are located.

2. The role of law enforcement: For cloud services providers, it is important to know how to manage law enforcement relationships. This may mean insisting on due process, challenging law enforcement demands that may jeopardize human rights and promoting good governance and the rule of law. The Global Network Initiative is a good example of a responsible approach that supports greater interaction between companies and governments to enforce laws that protect rights to privacy, security and freedom of expression.

3. The importance of raising awareness: Cloud services providers are experts in the field, and therefore have a responsibility to provide advice and guidance to users who know less about how the cloud affects privacy and freedom of expression.

The Changing Ethics of the Cloud

In our conversations with companies about cloud computing, we’ve encountered objections to some of the views expressed here. We’ve heard it argued that cloud services companies have no business trying to influence energy policy -- that this is the prerogative of the energy industry. We’ve also heard that cloud providers should stick to their core contribution of “dematerializing” the economy (reducing the number of physical materials needed to run the economy) and “enabling solutions.” And we’ve heard it argued that cloud services companies should avoid engaging in human rights, the rule of law and good governance in high-risk countries -- that governments know best and the role of business should be simply to follow their laws.

But it’s important to remember the core definition of corporate responsibility (as defined by the European Union, ISO26000 and many others), which emphasizes the role of business in supporting sustainable development. In this regard, cloud computing represents two shifts that are highly relevant. First, its highly networked, decentralized structure blurs jurisdictional lines, raising questions about accountability that effectively have never been asked. Second, today’s version of cloud computing is a mere embryo of what will be one of the most important industrial revolutions of the 21st century. As significant infrastructure is built for an industry whose equipment is reinvented every two or three years, decisions made today will establish the architecture and communities we will have to work with later.

As cloud computing takes hold and changes the profile of business, so too will it change notions of business ethics and corporate responsibility. There was once a time when business would argue that suppliers should take sole responsibility for following labor and environmental laws, yet today we see armies of auditors and labor relations specialists going above and beyond what is legally required. A similar transition will arise with cloud computing, and activities deemed outside the scope of corporate responsibility today -- challenging unreasonable law enforcement demands and meddling in energy policy -- will be mainstream tomorrow. Now is the time for today’s most innovative companies to define what that looks like in practice.

This article was originally published in the BSR Insight.