On Thursday cloud storage service Dropbox defended its privacy policies through a post on the company blog from founders Drew Houston and Arash Ferdowsi. This was a response to concerns over data security after a recent update in the company’s terms of service polices.
The policies were updated to clarify situations when Dropbox will turn over user data, such as complying with law enforcement requests. The new terms of service regarding the turn over of data is standard and is similar to policies used by Google, Twitter and other web companies. Earlier this year PayPal turned over records to Sony Entertainment based on a court case.
Much of the criticism stems from the impression that Dropbox employees were not able to access user data. This turns out to be a misunderstanding, according to CTO Ferdowsi, who says Dropbox employees are prohibited from accessing user data, but a small number of employees must be able to access data when required by law to do so.
According to Dropbox, the problem is not the new terms of service, but the previous version. The new version makes polices clearer and easier to interpret.
Part of the data access concern comes from the encryption method Dropbox uses. To make Dropbox easier to use, the service manages keys instead of the user. Meaning that Dropbox has the ability to decrypt and view files.
The encryption issue is a trade off for ease of use. Much of Dropbox’s popularity, 25 million users and counting, is no doubt due to how easy the service is to use. If users were required to manage their own keys the service would not be as simple to use. For those who want to manage their own keys there are other storage services that allows this. This would ensure that employees of the service do not have access to data, but would not prevent law enforcement from having access. Law enforcement would simply ask for the data to be decrypted regardless of who has the keys.
As with all cloud services, the best advice is to use them cautiously and not to depend on them unless the terms of service are fully understood.