Conversations about life & privacy in the digital age

SpiderOak Privacy Policy Update

At SpiderOak, our user’s privacy is valued above all else. This is the reason behind our ‘Zero-Knowledge Privacy Standard’ and why we will continually put privacy first as we develop into the future. With this in mind, we would like to inform our users of an update to the SpiderOak Privacy Policy. The changes can be summarized as follows:

1) Edits to the Better Business Bureau contact information

2) Include more firm and direct language around contacting a user should their information be requested by a third party

Regarding the second point, we have been working closely with the Electronic Frontier Foundation (EFF) over the last several years as we believe strongly in their mission – to fight for the digital rights of all users. During a recent conversation the EFF suggested we remove all possible doubt around the area of disclosure in the event that we are contacted by a third party to access data stored on our servers. To that end, we have included the following paragraph under our the ‘Disclosure’ section:

“SpiderOak’s policy is to notify a user of a request for their personal data stored on our servers prior to disclosure unless prohibited from doing so by statute or court order [e.g. U.S.C. § 2705(b)].”

To be clear, it has been our policy to make contact with any user should we be approached by a third party for the purpose of accessing a particular user’s data. The addition of this paragraph more plainly states our stance so that there may be no confusion or room for interpretation. I will add briefly that we have not yet been asked to relinquish end user data which we attribute directly to our ‘Zero-Knowledge Privacy Standard’.

Please feel free to send additional thoughts or questions about this change and/or any of our policies around protecting user privacy. We will continue to work with the EFF and others to ensure the rights of the user come first and foremost.

A special thank you to the EFF for continuing to help spread the word and draw that all-important line.

Comments

  1. a concerned User says:

    First of all, I would like to congrats you on the efforts and mission to ensure users privacy and data security.

    Regarding the second part – should you be required to give all information about a user, can you elaborate on the data you keep which is not client-side encrypted and thus available to demanding third party ?

  2. Jovan Washington says:

    Hi Concerned User,

    To be clear, we have not, nor will we ever, give third parties access to your private data. It undermines the very core of what SpiderOak believes in.

    To answer your question, I will direct you to a blog post our CTO, Alan, wrote explaining what would be available from demanding third parties.

    https://spideroak.com/blog/20091026143000-why-and-how-spideroak-architecture-is-different-than-other-online-storage-services-the-surprising-consequences-on-database-design-from-our-zero-knowledge-approach-to-privacy

  3. ERO - SpiderOak says:

    To 'A Concerned User': Thank you for your post. As Jovan mentions, we cannot ever turn over any of the plaintext data you have uploaded into your SpiderOak account.

    As it relates more directly to your question, we do have some plaintext information on who are users are (information we collect at signup), when they signed up for service, and billing information (if applicable). On purpose we collect the least amount of data possible on our users – just enough to create an account and use the service. Of course in a scenario where we were served with a proper and authoritative request, we would by law be required to turn over this information (as is mentioned in this update to our Privacy Policy).

    Please do let me know if that answers your question and/or you have any further thoughts moving forward. And thank you again for your consideration and patronage.

  4. warrant says:

    have you considered implementing a warrant canary like rsync.net as an additional measure?

  5. now a less concerned User says:

    Thanks for clarifying that! I read both the linked blog post and the comment of ERO (which was very informative).
    One last thing I was wondering – do you collect usage data ?(IP addresses, dates of access and etc)

    BTW, lately I find myself converting more and more DropBox users to your service, highlighting their recent "glitches" (4 hours of no authentication, latest vulnerability of iPhone app with plain text authentication string).

    Kudos for a great product.

    P.S. my questions might suggest I have something to hide, but it is really just a curiosity of a fellow security/privacy freak :)

  6. now a less concerned User says:

    +1 for a warrant canary as suggested above me.

  7. ERO - SpiderOak says:

    To 'Now A Less Concerned User': We do retain log files for varying amounts of time as they do play a critical role in the debugging process. That said, we do not keep the log files for longer than seven days at which point they are destroyed and can never be made available to a third party.

    Please let me know if that answers your question and don't hesitate to send further thoughts anytime.

  8. ERO - SpiderOak says:

    To Warrant: Thank you for your post. To be honest, we had not thought about implementing a 'warrant canary'; however, after talking about it internally with our team we do feel it would be a good additional to our privacy and security focus. We will work on making this part of our new website (which is launching soon).

  9. someone says:

    Have thought about moving the company (or at least the servers) out of USA to a more privacy friendly nation?
    The company's base country, server location and employee citizenship is my biggest problem with SpiderOak (the second biggest problem is closed source client and server software).

  10. ERO - SpiderOak says:

    To Someone: Thank you for sending in your questions. We have indeed thought about opening up data centers outside of the US including one in the EU (most likely Germany) and another in Asia. We do not have a definitive date set for this but hopefully before the end of the 2012.

    Regarding our code, the backend technology we use is open sourced as part of our Nimbus.io product. If you visit the project webpage – https://nimbus.io – you can access the code. The frontend we have not yet open sources but it has been the topic of much discussion internally. We will continue to think about what is best for our company in this regard but also continue to share code with the community when we can.

  11. Now A Less Concerned User says:

    To ERO – SpiderOak:
    Thanks for the prompt response, this sounds reasonable to me (log retaining and destroying.

  12. Concerned User says:

    Don't open a data centre in the UK or register offices here. The government here believes they have the right to have everyone's data and the courts honestly believe they rule the world and freedom of speech does not exist.

  13. Eden Caldas says:

    Client side encryption with closed source client is a no no.

  14. Eden Caldas says:

    Client side encryption with closed source client is a no no.

  15. Sarah Jacobs says:

    Eden Caldas:

    Why is a closed source client with client side encryption a no no? I have searched online and only found other people saying the same thing, but not explaining why. Someone on the internet said, closed source client was useless.

    Thanks,
    Sarah

  16. closed source :( says:

    "Why is a closed source client with client side encryption a no no?"

    because only a a very small, select group of people are able to verify the integrity of the application and it's code. as another example, having access to the code allows anyone interested (and indeed welcomes) verification of the statements made about the application, how it works, what it does or does not do.

    at present, we are given the choice to either wait until this changes, or extend the trust and risk (opening ourselves to risk and vulnerability) to a group of folks we can likely trust, or may like to trust, but which are inherently untrusted in the context of privacy, security, and zero-knowledge.

    openness creates the space for an inherently more liberating, constructive, and creative reality.

  17. Ex-pat Timmy says:

    I'd like to know if there has been any update on the topic of moving servers outside of the US. The last post here suggested that Spideroak hoped to have this accomplished before the end of 2012. Has it been done yet?

    One poster said that the servers should stay outside the EU because they have no privacy rights & no freedom of speech — this is true, altho data privacy laws tend to be stronger in many EU countries than in the US. The US gov't has the right to demand the data on any server in the US — even those that are foreign owned.

  18. Oh my goodness! Incredible article dude! Thanks, However I am having issues with your RSS. I don’t know why I can’t join it. Is there anyone else having identical RSS issues? Anyone who knows the solution can you kindly respond? Thanks!!