Dropbox's Government Data Requests Principles

[original PM]

if someone really wants your data and has enough money they will get it

[Sysman]

what is it that you guys store which is so sensitive?

It's not the value of the occasional spreadsheet or email but the value of those when collated with information from other sources.

The NSA revelations may be quite recent, but there were suspicions 20 or 30 years ago that the Yanks were using data collected by their monitoring services to give Yank companies an economic advantage.

[Sysman]

if someone really wants your data and has enough money they will get it

In which case they could try offering hard cash rather than trying to steal it.

[DaveB]

If you're worried about such tactics, why bother worrying about Dropbox being on American servers anyway?

I'm not worried about it and I use it. Your point about being in control of the keys by using your own devices is irrelevant, is the point I was making. If someone wants them, they will get them or you will end up in jail (or worse) anyway.

The question anyone needs to ask themselves before using DropBox or any other solution is "Is the level of privacy it gives appropriate for what I want to use it for?"

If it is, then use it. If it isn't then look for something else.

Once you accept that privacy is relative you can start making realistic decisions about how you manage it.

[DaveB]

It's secure enough for the CIA to use Amazon for a lot of their data.

I'm sure they do, but you can bet your day rate that they've done a risk assessment that says they are comfortable with the level of security available agaiinst the sensitivity of the information involved. And they wont be keeping any state secrets or other properly sensitive stuff on there.

[DirtyDog]

I'm not worried about it and I use it. Your point about being in control of the keys by using your own devices is irrelevant, is the point I was making. If someone wants them, they will get them or you will end up in jail (or worse) anyway.

I don't think it's irrelevant to be in control of the keys to be away from American authorities. If you are based outside the US, then the American government would need to apply for a court order in this country to disclose the keys.

If you aren't in control of the keys, then the company that is in control of the key is the important thing - and if they are in America, and the server is in America, then the chances of them getting the key is much higher than if they had to go through the British court system.

I agree that if someone wants it badly enough, they will get it.