According to a complaint submitted to the Federal Trade Commission on May 11, 2011, the popular cloud-based data storage provider Dropbox, Inc. made false claims about the security of its users’ data, thereby putting them at risk while gaining an unfair advantage over competitors that actually offer the sort of security Dropbox advertised.  The Dropbox service allows users to create folders on their computers that automatically sync with corresponding folders on Dropbox’s servers.  Users can specify whether their folders are public or private.  The allegations concern the folders designated as private, which are touted as being protected by encryption.  According to the complaint, which was filed by Christopher Soghoian (a security researcher and former technologist at the FTC’s Division of Privacy and Identity Protection), although Dropbox represented that its encryption features would render a user’s files completely inaccessible to any person other than the user, in fact, Dropbox employees maintained copies of the encryption keys and could therefore access the contents of users’ files.  This left Dropbox users’ files susceptible to unauthorized access (e.g., governmental demands for data, hacking attacks, rogue insiders).

The complaint states that Dropbox’s access to unencrypted file content allows the company to save server space as well as bandwidth costs associated with multiple uploads of the same file.  When a user attempts to upload a file to his or her Dropbox space, Dropbox compares the contents of the file with all the other files on its system.  If another user has already uploaded the same file, Dropbox merely associates the previously uploaded copy of the file with the new user’s space instead of storing a duplicate copy.  The complaint charges that this puts Dropbox at an advantage over competing services that cannot engage in a de-duplication process because they store each user’s encryption keys locally, on the user’s device, and therefore have no access to the contents of their users’ files.

Dropbox denies wrongdoing, but allegedly changed certain security representations on its website, including the following, after Mr. Soghoian helped bring the issue to the public’s attention in April 2011: 

Representation before Mr. Soghoian complained to Dropbox Representation after Mr. Soghoian
complained to Dropbox
 “All files stored on Dropbox servers are encrypted (AES-256) and are inaccessible without your account password.”  “All files stored on Dropbox servers are encrypted (AES-256).”
 “Nobody can see your private files in Dropbox unless you deliberately invite them or put them in your public folder.”  “Other Dropbox users can’t see your private files in Dropbox unless you deliberately invite them or put them in your Public folder.”
 “Dropbox employees aren’t able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc, not the file contents).”  “Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata (e.g., file names and locations).”
 N/A  “Like most online services, we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy (e.g., when legally required to do so).  But that’s the rare exception, not the rule.  We have strict policy and technical access controls that prohibit employee access except in these rare circumstances.”

In addition, Dropbox allegedly represented that all transmissions involving its mobile applications were encrypted, when in fact its mobile application for Android does not encrypt transmissions.  The complaint alleges that Dropbox’s conduct constitutes an unfair or deceptive trade practice within the meaning of Section 5 of the FTC Act.

Mr. Soghoian, who submitted the complaint in his personal capacity, is a Graduate Fellow at the Center for Applied Cybersecurity Research at Indiana University and a Ph.D. candidate in the School of Informatics and Computing at Indiana University.