Why misleading your customers is a bad strategy



The change: a clause indicating that Dropbox will "[cooperate] with United States law enforcement when it receives valid legal process, which may require Dropbox to provide the contents of your private Dropbox".

As part of this, the company "will remove Dropbox’s encryption from the files before providing them to law enforcement." Standard fare legal terms typical for such a service, right?

Yes, but there's just one problem: Dropbox isn't supposed to be able to do this. As noted by software developer Miguel de Icaza, who started the GNOME project, Dropbox has previously created the impression that it can't access user files even if it wants to.

In addition to promoting the fact that "All files stored on Dropbox are encrypted", it tells prospective users that "Dropbox employees are unable to view user files." This is reiterated over and over again: "Dropbox employees aren't able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents)".

To lay users in particular, the message seems clear: "your files are safe with us, and even we can't access them".

Obviously, this issue is somewhat academic, as most users aren't going to find themselves the subject of a legal process. But it does call into question how Dropbox promotes itself. At a minimum, it seems fair to say that it is being misleading in how it presents its security features.

That's a bad strategy for a company with a lot of potential. Already, Dropbox's Terms of Service change is only serving to highlight serious questions about the company's entire security architecture, and it provides an opening for companies that are more transparent about theirs. Will this put a dent in its growth? Probably not, at least in the immediate term.

But as we've seen, where there's a vulnerability, there's a way, and if and when a Dropbox security issue emerges in the real world, Dropbox may learn the hard way that users are a lot less forgiving when they feel like they've been misled.


Topics: Strategy & Operations
Add your own

Reader comments (5)

  1. Avatar-blank-50x50 Peter Austin, MarketingXD

    8:08PM on 21st April 2011

    Dropbox seem to be changing this wording every day. The current version seems to have got even looser. It's at:


    So Dropbox will provide files to "parties outside Dropbox" if "we have a good faith belief that disclosure is reasonably necessary to comply with a ... regulation".

    This means they would not only give your information to the police, but also to e.g. tax authorities such as the IRS or Inland Revenue. And I wonder what would happen if the RIAA came knocking?

  2. Avatar-blank-50x50 DAVIES M M

    9:43PM on 21st April 2011

    Data protection is a very important entity of any business dealing.

    It is therefore important that Cloud file storage and syncing service Dropbox ensures people using the service are protected and ofcourse in compliance with the law.

    Compliance with the Law cannot be overlooked as this is vital and good for the security of the general public.

  3. Avatar-blank-50x50 Lewis LaLanne aka Nerd #2

    8:45AM on 22nd April 2011

    The internet is still in the Wild Wild West era.

    Being that's the case, I don't trust any kind of storage online, especially when it comes to a government who uses force to get what they want.

    Prison/freezing of assets/and god knows what else they threaten... or let them see what I have in my folders in the interest of national security... not a tough decision when I put myself in the shoes of 99.9% of the the the corporate boards running these companies.

    Unless I know there's a Larry Flynt behind a company, I don't pay any mind to any promises of keeping my data secure from the government.

  4. Avatar-blank-50x50 Teran Vista

    4:46PM on 22nd April 2011

    Misleading your customer do nothing except of spoiling your image. It take too much time in developing good will but you lose all in just one second. Always be supportive to your customers and help them as much as you can. Ensure them that you are here for there help not for to just earn money.

  5. Avatar-blank-50x50 Jesse Barnes

    7:40PM on 22nd April 2011

    Yikes~! That's unfortunate. For them, I mean. People don't react to this type of thing well at all. At least not on the internet where you've got mob mentality AND anonymity.

Log in to post a comment