Concerns raised about Amazon's Cloud Drive and privacy

• Tweet

March 31st, 2011 - Posted by Kent

An article over at ZDNET is raising privacy concerns about Amazon's new music-streaming Cloud Drive service. Writer Steven J. Vaughan-Nichols notes that Amazon's terms of use give the service carte blanche to access user files. Amazon.com's TOS (Terms of Service) states that:

5.2 Our Right to Access Your Files. You give us the right to access, retain, use and disclose your account information and Your Files: to provide you with technical support and address technical issues; to investigate compliance with the terms of this Agreement, enforce the terms of this Agreement and protect the Service and its users from fraud or security threats; or as we determine is necessary to provide the Service or comply with applicable law.

This might not seem like a big deal, but pay attention to the part where they say they can access your files to "investigate compliance with the terms of this agreement." Compliance, in section 5.1, means:

that you have all the necessary rights in Your Files that permit you to use the Service without infringing the rights of any copyright owners, violating any applicable laws or violating the terms of any license or agreement to which you are bound."

Vaughan-Nichols worries this could lead Amazon to sweep user accounts looking for material that violates copyright, and then hand over those user accounts to the RIAA (Recording Industry Association of America) for enforcement. Is this really different from other online backup service providers like SugarSync? SugarSync's TOS simply states that:

We respect the privacy and confidentiality of your Files, so we agree never to disclose your Files to anyone unless you instruct us to do so or a court orders us to disclose them, as provided in our Privacy Policy.

SugarSync's TOS also contains provisions against abuse of the system, which includes anything that might "violate or infringe the rights of third parties, or expose SugarSync to any actual or potential civil or criminal liability." That could theoretically include material that violates copyright. They also don't want nudity. But will they go into your files to find it?

Content screening is a big, ugly can of worms for any Internet service provider to get into. There are liability issues, true, but it's also difficult to do; there's simply too much data to make combing through every file worthwhile. Amazon, however, has a much cozier relationship with the RIAA and the labels it represents. YouTube is already using its Content ID system to let entertainment companies find unauthorized uses of their material on the video sharing site. Amazon could employ a similar mechanism to allow entertainment companies to identify infringing files.

I don't think Amazon's terms of service are too terribly different from anyone else's. They must comply with the law, specifically the Digital Millennium Copyright Act, but also with subpoenas from law enforcement related to more serious crimes. Any Internet service provider would have to do the same. There's another reason that Internet service providers don't get into pro-active content screening: It makes them liable for everything stored on their servers. As it is, they're only responsible for what they know about. If and how Amazon might allow entertainment companies to look for infringing content through a system like Content ID is unknown.

But let's take a step back. In the end, much of it comes down to user responsibility. Everyone should know by now that copyright violation is illegal. Amazon's Cloud Drive is primarily meant as storage for MP3s legally purchased or ripped from CDs owned by the account holder. Stick to that, and you'll be fine. Cloud Drive is not a great online backup service for other files because it's not automatic. Those worried about Amazon sniffing through their personal files would be better off going through a service like Carbonite, Mozy or IDrive which handles automatic backup and lets you manage your own personal encryption key. That way no one but you can read your files—just don't lose your encryption key.