Privacy & Information Security Law Blog

According to a complaint submitted to the Federal Trade Commission on May 11, 2011, the popular cloud-based data storage provider Dropbox, Inc. made false claims about the security of its users’ data, thereby putting them at risk while gaining an unfair advantage over competitors that actually offer the sort of security Dropbox advertised.  The Dropbox service allows users to create folders on their computers that automatically sync with corresponding folders on Dropbox’s servers.  Users can specify whether their folders are public or private.  The allegations concern the folders designated as private, which are touted as being protected by encryption.  According to the complaint, which was filed by Christopher Soghoian (a security researcher and former technologist at the FTC’s Division of Privacy and Identity Protection), although Dropbox represented that its encryption features would render a user’s files completely inaccessible to any person other than the user, in fact, Dropbox employees maintained copies of the encryption keys and could therefore access the contents of users’ files.  This left Dropbox users’ files susceptible to unauthorized access (e.g., governmental demands for data, hacking attacks, rogue insiders).

The complaint states that Dropbox’s access to unencrypted file content allows the company to save server space as well as bandwidth costs associated with multiple uploads of the same file.  When a user attempts to upload a file to his or her Dropbox space, Dropbox compares the contents of the file with all the other files on its system.  If another user has already uploaded the same file, Dropbox merely associates the previously uploaded copy of the file with the new user’s space instead of storing a duplicate copy.  The complaint charges that this puts Dropbox at an advantage over competing services that cannot engage in a de-duplication process because they store each user’s encryption keys locally, on the user’s device, and therefore have no access to the contents of their users’ files.

Dropbox denies wrongdoing, but allegedly changed certain security representations on its website, including the following, after Mr. Soghoian helped bring the issue to the public’s attention in April 2011:

In addition, Dropbox allegedly represented that all transmissions involving its mobile applications were encrypted, when in fact its mobile application for Android does not encrypt transmissions.  The complaint alleges that Dropbox’s conduct constitutes an unfair or deceptive trade practice within the meaning of Section 5 of the FTC Act.

Mr. Soghoian, who submitted the complaint in his personal capacity, is a Graduate Fellow at the Center for Applied Cybersecurity Research at Indiana University and a Ph.D. candidate in the School of Informatics and Computing at Indiana University.