¡SpiderOak, Sí. Dropbox, No!

It is almost unfathomable to me that a lawyer would give up confidential client information without a fight.

Yet Sam Glover at The Lawyerist suggests that this might be an option: “If you are the sort of person who would fight such a subpoena, this would give you the option to do so.”

The context: Glover is talking about using SpiderOak for file sync instead of Dropbox.

Dropbox and SpiderOak both provide options for synchronizing data between computers and storing it in the cloud. While Dropbox has access to your data, SpiderOak has zero-knowledge encryption: data are encrypted on your end, and SpiderOak could not decrypt them even if ordered to.

What that means is that if the bad guys want to get your clients’ data from Dropbox, they can get a subpoena or a court order and serve it on Dropbox; not only can you not fight it, but you might not know about it. If the bad guys want to get your clients’ data from SpiderOak they have to go through you.

If someone comes to me with a subpoena for clients’ data, I will fight it. If I am ordered to comply, I will decide whether the principle is worth going to jail. But I hold myself to a high standard, and sometimes I forget that others’ standards are lower. Maybe it’s acceptable for non-criminal-defense lawyers to give up clients’ confidential information without a fight. So let us not be too hard on Glover.

Let us limit the discussion to criminal-defense lawyers.

For online data backup in a criminal-defense practice, Dropbox is not an option

Backing up data off-site is indispensable. Syncing data among multiple computers (home desktop, laptop, office desktop) is invaluable. Sharing data with clients is useful. To do all of this I used to use Dropbox. Once I considered the confidentiality implications, however, I realized that it was a mistake. Now I will use Dropbox to share with clients stuff that the government already has, and sometimes for sharing large non-sensitive files, but never for anything that would be damaging to the client’s case if the government got it. If the government is going to subpoena my files, I want to be the gatekeeper.

Glover, quoting Eric Cooperstein, points out that “Dropbox is more secure than anything most lawyers have used to secure their files from the Battle of Hastings until about 5 or 10 years ago.”

This is probably true—breaking into an office is less of a technical challenge to the government than subpoenaing files from DropBox. But Dropbox creates a different sort of insecurity from scrolls stored in a chest. With Dropbox, copies of the scrolls are held by a third party, and the lawyer has no idea what that third party is doing with them. Aside from the fact that sneak-and-peak warrants are harder to get than subpoenas, at one point Dropbox was claiming the right to use customers’ data. They’ve backed off on that claim, but the making of it was enough motivation for me to switch to SpiderOak.

Further, if anyone but you has access to your encryption key (the case with Dropbox) then anyone who hacks them might have access to the key as well. With Dropbox, you’ve given a third party a copy of all of your scrolls; that third party has a duplicate of the key to your chest, which he keeps in his pocket with a bunch of other people’s keys; and there are a thousand thieves actively trying to pick his pockets. If you can’t imagine a dozen things that might go wrong, you’re not trying very hard.

If you are not the sort of person who would fight a subpoena for your client’s records, I hope that you aren’t defending people. If you are, I hope that you’ll take seriously the risk that Dropbox presents.

When a single data breach could ruin many clients’ lives, “reasonable” security—the standard propounded by Cooperstein and Glover (and apparently approved by bar associations)—is not good enough. Only the extreme will do.

(P.S. if you keep client data on a laptop, go now and encrypt the hard drive so that when your laptop gets stolen you won’t have to worry much about your clients’ secrets.)

Revenge Porn and “Rape Culture” Culture

Business Insider found some folks who see revenge porn not as a free-speech issue but as “a kind of high tech rape”:

When we teach women not to walk alone in public after dark, not to wear particular kinds of clothing, not to engage in consensual acts like taking nude photos or making sex tapes, we’re saying that women can expect to be victims because they are women, and that it is more important to limit a victim’s participation in public life than it is to remedy the systemic injustices that lead to victimization in the first place. Revenge porn is merely a high tech piece of rape culture, and sadly it doesn’t say anything about our culture that we didn’t already know.

Wait, what?

When we teach women? How condescending is that?

I don’t think grownups teach grownups much. So let’s talk about those whom we have some chance of influencing: our kids.

When we teach our daughters not to take nude photos, we’re saying that women can expect to be victims because they are women, and that it is more important to limit a victim’s participation in public life than it is to remedy the systemic injustices that lead to victimization in the first place?

Making sex tapes is participation in public life?

This victimocracy is criminally insane. 

Those among us who are not insane victimocrats teach our children to live happy, productive, self-reliant lives in the world as it is, and to try to make it a better world.

When we teach our children to lock the doors at night, we are not saying that they can expect to be victims. We are teaching them, rather, to take their safety into their own hands.

Do we wish that doors did not have to be locked at night, that keys could be left in ignitions, that attackers never lurked in the dark? Absolutely. But that is not the world we inhabit.

When we teach our children to dress appropriately for their surroundings, and that they don’t get to choose what is appropriate, we are not teaching them that it is not important “to remedy the systemic injustices that lead to victimization in the first place.” We are teaching them to take responsibility for their own safety and pay attention to their surroundings.

Mitigating risks and remedying injustice are not mutually exclusive; in fact they are complementary. It’s hard to remedy systemic injustices from a hospital bed, and harder from a grave.

The victims of revenge-porn websites should not have allowed the pictures to be taken. This is not moralization, but indisuputable truth with which the victims would certainly, in hindsight, agree. The victimizers should not have shared the pictures. So what lessons can we impart to our children? Obviously, not to violate others’ trust. But also to be extremely careful where they place their own trust.

Clearly, sending naked pictures to your lover has potential benefits. But people have had great sex lives for tens of thousands of years without the benefit of iPhones. Would you teach your children that they should put a loaded gun in the hands of a lover? Why teach them that it’s an unreservedly good idea to put nude photos or sex tapes in that same lover’s hands? The world is full of betrayals; if you trust someone with your secrets, that person may some day betray that trust. Once you’re grown up (this will be later than you think) you will probably be able to count on your fingers the number of people you can trust absolutely, now and forever, and if you don’t have any fingers left over you’re a lucky person indeed. 

If we don’t teach our children to keep themselves safe, we are doing them a disservice, not preparing them for the realities of the world.

A browse of one of the sites named in the Business Insider article (the things I do for my readers!) revealed men’s photos as well as women’s posted. So what about that?

When we teach our sons not to make sex tapes, are we saying that men can expect to be victims because they are men? 

And if we are saying that women qua women can expect to be victims and men qua men can expect to be victims, aren’t we teaching everyone to expect to be victims?

When you fetishize victimhood, everything is about being a victim. 

But of course it’s nonsense. We’re not doing that. We’re fighting victimhood. We’re teaching our children, if we’re doing our job, that the world can be a dangerous place for the unwary, and that decisions made in the heat of passion can have far-reaching consequences. The world is dangerous, but it doesn’t have to be scary: with some preparation, we can mitigate the risks and probably not be victims while living full lives.

At the same time that we’re teaching our children to balance life’s risks against its rewards, we’re teaching them to be good people and to minimize the consequences of others’ decisions. We teach them on the one hand to be careful where they walk alone after dark, and on the other to protect others walking alone after dark.

Do women face more danger than men? The risks for men and the risks for women are different. Women are more likely to be chosen as victims of predatory attacks because most attackers are men and most women are smaller, with less upper-body strength—predators look for maximum reward and minimum risk. On the other hand, men are more likely to be the victims of hotblooded attacks because young men antagonize each other. This is all physiology, ethology, and endocrinology; we are going to change none of it by changing our culture.

It is true, though, that our culture is screwed up in many ways that we must address:

It is decadent and degrading.

It sexualizes our children.

It teaches us to worship consumption.

It creates irrational fear.

And it fetishizes victimhood.