Box Offers Extra Encryption in Bid for Additional Trust

[Nico@FMA]

Content source

http://blogs.wsj.com/digits/2015/02/10/box-offers-extra-encryption-in-bid-for-additional-trust/?mod=rss_Technology

Box wants customers to trust it with their most sensitive data. So the cloud-storage and -management company Tuesday said it will soon offer extra encryption that Box says will keep everyone out – even Box.

For an undisclosed fee, Box customers will manage the encryption keys used to scramble their data housed on Box servers. In theory, that means only the customer, or people authorized by the customer, will have access to the files.

The new offering checks three strategic boxes for Box.

- It could help win confidence among companies with highly sensitive information, in industries such as banking, specialized manufacturing or health care.

- It could make overseas customers more comfortable handing data to an American company. The Edward Snowden leaks showed international customers that the U.S. government uses court orders to obtain data on the users of Silicon Valley companies. In theory, the new services would prevent Box from handing over user content.

- It’s a new source of revenue for Box, which started trading shares publicly last month amid promises from Chief Executive Aaron Levie to boost revenue.

Files stored on Box are routinely encrypted. When a customer logs in, the password tells Box to decrypt the file with a special key for that file. Box keeps that key on its servers.

The new offering will add a second layer of encryption that requires a key stored elsewhere.

Box customers will rent space on encryption-key storage devices managed by Amazon Web Services. Made by SafeNet, the device is allegedly tamper-proof and logs all requests for the keys it holds. Amazon rents use of them to its customers.

Amazon and Box maintain they can’t access user data, because they have no access to the SafeNet device.

It’s unclear how much the service will cost. Box said the price will be based in part on the number of licenses a company buys. The customer also has to pay Amazon Web Services for the use of the encryption-key generator, which, on average, can cost $5,000 up front and more than $1,300 a month, according to Amazon’s website.


Personal edit: Now even tho i would applaud this whole hearty, i ask the question would US law not force the company to make the files available if law enforcement agencies request it, because due to the fact i have my own company and i am having lots of customer data on the servers, i know for a fact that if my server resides in the US i will have to give access no matter what. As the patriot act and some of these other laws state. So is this false advertisement?

 

[hjlbx]

Nico@FMA, post: 347677, member: 8154[/EMAIL]]
Personal edit: Now even tho i would applaud this whole hearty, i ask the question would US law not force the company to make the files available if law enforcement agencies request it, because due to the fact i have my own company and i am having lots of customer data on the servers, i know for a fact that if my server resides in the US i will have to give access no matter what. As the patriot act and some of these other laws state. So is this false advertisement?

Hello Nico,

My qualification for answering this question is my background in fraud examination.

In the US there exists no specific "key disclosure" laws.

A court (more specifically a judge) can compel Box to turn over the encrypted files. As you know, the mechanism is via a subpoena. They bear no duty to decrypt the data if they did not encrypt it and/or they do not possess the key.

Here in the US, if it is a criminal case (not involving any national security violations) and the defendant is the only party that possesses decryption keys, the current Federal case law establishes that a court cannot compel the defendant to disclose keys. A federal appeals court ruled that it is a violation of the 5th Amendment which provides that a defendant cannot be compelled to incriminate themselves.

If US national security is involved, then the Federal Bureau of Investigation can issue a "National Security Letter" which compels one to divulge encryption keys.

However, in all cases, one can simply refuse to comply. No one here in the US has a duty to cooperate with criminal investigations in so far that one does not have control over evidence. With regards to information one can simply take a posture of "no comment." At its worst, one can be sanctioned, up to and including imprisonment, for contempt of court (not complying with a court order or subpoena), but that is rather uncommon.

Law Enforcement can seize your server if a customer used it for criminal purposes. You must let them take it for their investigation.

 

[Nico@FMA]

Hello Nico,

My qualification for answering this question is my background in fraud examination.

In the US there exists no specific "key disclosure" laws.

A court (more specifically a judge) can compel Box to turn over the encrypted files. As you know, the mechanism is via a subpoena.

Here in the US, if it is a criminal case (not involving any national security violations) and the defendant is the only party that possesses decryption keys, the current Federal case law establishes that a court cannot compel the defendant to disclose keys. A federal appeals court ruled that it is a violation of the 5th Amendment which provides that a defendant cannot be compelled to incriminate themselves.

If US national security is involved, then the Federal Bureau of Investigation can issue a "National Security Letter" which compels one to divulge encryption keys.

However, in all cases, one can simply refuse to comply. It may or may not result in sanctions, up to and including, imprisonment.

Actually i can contest that law, because yes its written that way, however a court will issue any court order requested by for example the NSA, CIA, FBI and other agencies. Refusal by a company will result in very heavy fine and forced seizure of data, and i know this pretty much first hand from one of our Dutch clients who did have a datacenter in the US. They literally seized control of the affected server and took every bit of data that the server has processed next to the fact that they installed specific software that searched the whole data center and even datacenters connected to it abroad. No warning nothing just a piece of paper with a written signature by some judge. No court, no trail nothing... and in the end it was not even probably cause.
Also they where forced to hand them the master encryption key and the actual source of the crypt engine.

Ill guess that technical and reality are 2 different worlds.
But yes thank you very much for your info as its correct its just reality is different hence my question still stands.

 

[tallorder]

I have a strange event happening, let me see if it posts just the way I see it: Letters are missing, both in Nico's name (Nico@FMA), and in the responses. Not just in Nico@FMA 's , but in everybody's.

 

[hjlbx]

Ah...law enforcement only needs a signed warrant (for seizure of evidence) and you must allow them to take it.

If you resist you can be charged with obstruction, evidence tampering, aiding and abetting, etc, etc...depending upon what you do.

If national security is involved, then protecting a key is the least of your worries. You have virtually no constitutional protections and they can detain you indefinitely. You're beat. You got nothin'!

 

[Nico@FMA]

Ah...law enforcement only needs a signed warrant (for seizure of evidence) and you must allow them to take it.

If you resist you can be charged with obstruction, evidence tampering, aiding and abetting, etc, etc...depending upon what you do.

If national security is involved, then protecting a key is the least of your worries. You have virtually no constitutional protections and they can detain you indefinitely. You're beat. You got nothin'!

Yeah national what was that? lol what about international customer rights and privacy, why showing a warrant for mister X but you only take the data from mister (the rest of the alfabet) while mister X is not even a customer? Just saying and yes again you are right today even taking a ##### is national security.