
Dropbox is one of our favorite online storage services but there are reasons that you may not want to use them. Dropbox recently changed their terms of service and some very interesting things came to light that you may not be aware. We have highlighted the relevant topics.
- Even though Dropbox does encrypt the data the encryption is not done at the clients end-point but at Dropbox. Dropbox does use SSL to transfer the data in an encrypted form but it arrives at the Dropbox service unencrypted.
- Dropbox encrypts your data with their own encryption keys. This means that it is Dropbox who can encrypt and decrypt YOUR data at their will.
- As set forth in the new Terms of Service "Like most online services, we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy"..."e.g., when legally required to do so." This basically means that if they were served with a court order they would comply with the government agency that is requesting the data. Furthermore they clearly state "As set forth in our privacy policy, and in compliance with United States law, Dropbox cooperates with United States law enforcement when it receives valid legal process, which may require Dropbox to provide the contents of your private Dropbox. In these cases, Dropbox will remove Dropbox's encryption from the files before providing them to law enforcement."
Bottom line here is that you have to encrypt your data yourself BEFORE you upload it to dropbox. This may have implications for HIPAA, Sarbanes-Oxley and other initiatives.