Terms of (Dis)Service...
From the original Analog Industries archive. Some links and images from that era no longer resolve.
This is a subject which will no doubt be incredibly un-interesting to you, but which should be paid attention to. I’m not gonna do it in the neck-bearded “Information Wants To Be Free” bullshit arm-waving way, and neither am I gonna give in to the “well, I’m sure they mean well…” frame of mind. I’ll just present the facts, and my interpretation of the ramifications, and let you come to your own conclusion.
On Friday last, DropBox, a service we all know and use (it figures heavily in to the Audio Damage workday, for instance) changed their Terms Of Service, and specifically the rules regarding the rights to your uploaded files, to read as follows:
We sometimes need your permission to do what you ask us to do with your stuff (for example, hosting, making public, or sharing your files). By submitting your stuff to the Services, you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent reasonably necessary for the Service. This license is solely to enable us to technically administer, display, and operate the Services.
Now, any musician that has ever done work-for-hire will recognize that wording. It is the general “I made this, you paid me” boilerplate that we see all the time. So what’s it doing here in the DropBox TOS? And why do I care? The problem here is that the wording is so vague that it serves as a catch-all for any possible scenario. Of particular note is this bit: rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display
Now, any normal, reasonable person would be all “well, they need to, e.g., make thumbnails for your Public folder, blah, blah, blah.” And that’s fine, and totally acceptable. They want licensing terms that remove any possible potential lawsuit from that. I can accept that. The problem isn’t that, but rather that the wording is so broad as to include virtually any scenario they might feel is appropriate. They say “[t]his license is solely to enable us to technically administer, display, and operate the Services.” That makes perfect sense on the face of it, but what does that even mean?
Now, you’re thinking “Chris, you’ve gone off your rocker. Any reasonable person knows exactly what it means.” And you’re absolutely right.
But I’ll tell you what I’m right about: lawyers are not reasonable people. And the boards of large corporations aren’t reasonable people either. And these people make their living exploring the hazy area between the intent of a contract and its actual wording. And they make good livings. And they’re way, way better at reading and interpreting that intent than you or I are. Sure, DropBox is run by reasonable people. Now. What about next week when it is purchased by Yahoo. Or Google. Or the marketing company that bought MySpace?
Now, it doesn’t have to be like this. Look at, for instance, the relevant passage in the TOS of Box.net:
By registering to use the Services, you understand and acknowledge that Box.net and its contractors retain an irrevocable, royalty-free, worldwide license to use, copy, and publicly display such content for the sole purpose of providing to you the Services for which you have registered. In the event that you give Box.net the right to distribute your content, additional terms may apply to Box.net’s usage or distribution of this content. You continue to retain all ownership rights in any User Content you provide and shall remain solely responsible for your conduct, your User Content, and any material or information transmitted to other Users for interaction with other Users. Box.net does not claim any ownership rights in any User Content.
This is much less open to interpretation, and still makes perfect sense. Or how about SugarSync? Same thing:
After setting up your account and downloading our Software, you can select the Files you want to sync and/or store. You can change the Files you want to sync or store whenever you want. In order to make the Service available to you, we need your permission to sync and store your Files. Accordingly, you hereby grant to SugarSync a license: (i) to use, copy, transmit, distribute, store and cache Files that you choose to sync and/or store; and (ii) to copy, transmit, publish, and distribute to others the Files as you designate, whether through the sharing or public linking features of the Service, in each case solely to provide the Service to you.
So, I’m going to give DropBox a few days to pull their collective heads out of their collective asses and get with the program. But the simple fact of the matter is that their wording is so broad that it includes virtually any purpose they could conceivably come up with, and that’s simply unacceptable.
EDIT: I don’t know if this blog post or my letters had anything to do with anything (although, in my defense, I was quoted in several blogs of more, uh, respectability?) but on Tuesday they updated their TOS to define “stuff” (one of my major complaints) and clarify the points of contention. It is essentially in line with the other two TOS I quoted above now.
22 comments
I'd feel a bit more concerned if the last bit were not there: 'to the extent reasonably necessary for the Service. This license is solely to enable us to technically administer, display, and operate the Services.'
I think a big part of the problem is that the law ends up getting abused by both sides of the fence. A company doesn't word things generally enough, and some asshole takes advantage of it. A company words things to vaguely and it puts their customer base at risk for being taken advantage of.
I depend on dropbox at work as well, however the files that are being shared are so obscure that they would be useless to practically anyone. And even then, I doubt anyone would be ridiculous enough to care to look through the most boring database tables in the world. I am not too concerned, however that would change if it had anything to do with my music.
I had exactly the seem confused feeling when I recieved their 'update' yesterday.
The line that reads:
'you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent reasonably necessary for the Service.'
seemes very alarming to me. Not that I have anything to worry about, I just can't stand the idea that the Service can be messed with (aka derivative works) in a freely matter without any questions asked.
We use drop box at work. I sent the TOS update to our legal department and they immediately told us to stop using the service. For several reasons, thats easier said than done, but we will make the switch to SugarSync or another service that does NOT have this kind of vague wording used in it's TOS.
I use Dropbox quite a bit and *everything* that I care about is either stored on an encrypted volume in my dropbox folder or itself encrypted.
It's a minor hassle but provides a lot of piece of mind. It may not work well for multiple people collaborating, but for individuals I highly recommend it.
Of course this doesn't excuse their TOS wording. But even if their TOS was all love and baby sheep I'd still be doing this.
The problem isn't the law or the wording of the contract, the problem is that any legal conflict with a large corporation has less to do with the wording of contracts than it does with how much you can afford to spend on legal representation. That's why 'fair use' has been weakened into meaninglessness. The artist using 'fair use' might have a great case but if they're up against a giant mulitinational corporation, they lose before they even begin to contest the issue.
But yeah, they could have worded their contract to protect themselves without making it sound like they reserve the right to steal your work.
I think it's inevitable that any of the modern services or systems that we use will eventually be co-opted into the corporatized mainstream of "shit you no longer want to use/do/watch/hear" and people who are under the age of "fuck it I just want my social security check" will tend to move on at the speeds that are natural to where they stand on the novelty train.
Take Skype for instance, it's not *really* been trustworthy since .de made a stink over the cryptography (which is in theory secure still but the discussion over the data infrastructure in .de itself disappeared REAL fast). And now fast forward a few years past when anyone concerned about their own financial/corporate/etc interests should have moved on and their new corporate masters outright admitted that one of the first things they'll do is insure that the software has easy access to do "Legal Intercept" (meaning that it's now even in their TOS!)
Was planning on reading the new TOS over the 4th (cuz reading legalese is how I party), but thanks to you I don't have to. Another of the great services provided by AI!
But, yeah... that is one stupidly worded TOS. What the fuck was their legal team thinking. They have to make an update to this or I'm not using DropBox anymore. It's that word "reasonably" that worries me. Their version of reasonable and MY version of reasonable could be VERY far apart. Sure we can hash that out in court, but I don't have the money to dance that legal dance with them. It's a clear case of better safe than sorry.
I like DropBox. It fits in my workflow quite well, but I've also used Linux extensively since Slackware 2.0. I'm not afraid of doing things the hard way. There are other tools and other methods to do what DropBox does. I'll give them a bit of time to send out a reworked TOS, but not a whole lot of time.
Damn... And the interwebs were just getting to the point where they worked for me again...
-William
I'll be encrypting my files. I've also sent an email to the legal department of dropbox asking for a clarification. I doubt I'll get a response.
I wrote them this morning asking for clarification, on a Sunday, natch, and got a reply within like 20 minutes. It was nearly a boilerplate response, almost copied verbatim from the TOS:
"Dropbox does make any claims on your files. That part of the Terms of Service is mostly for file sharing, picture galleries and public links. This license is solely to enable us to technically administer, display, and operate the Services.
Please read the updated blog entry (scroll down): http://blog.dropbox.com/?p=846
Thank you.
Best,
Kevin
Dropbox"
Note there is a typo in the first sentence (honest mistake, albeit a somewhat ironic one given the context) and a few minutes later I got a correction. So someone actually read my letter and took the time to respond.
I sent a further half a K of extemporaneous rambling (essentially this post, with the pronouns changed) and didn't hear back after that.
-CR
@pranafire: that's a copy & paste from their blog entry. Looks like they're in damage-control mode now.
The problem IMHO is this: while they may say that their _intent_ is that they "don't own your stuff", that's not what the TOS actually _says_. Besides being horribly vague, the TOS says --oh, nevermind, just re-read the first black-italicized text in CR's post. That does not say "we don't own your stuff." It says the opposite.
If anyone besides myself is wondering how to purge files from DropBox for good (remember that a backup and versioning mechanism is one of its features), it looks like the answer is here: https://www.dropbox.com/help/40?ss=1&ft=help
--Adam
Things like this make me consider keeping all of my stuff in Drop Box in a True Crypt container. That defeats the ability to view document son my iPhone though. The trade off of convenience and peace of mind.
Corporations have the great knack of profiting from peoples ignorance and as you stated most people who show concern for these type of things are branded "crazy". Even though you are merely protecting your intellectual property and/or private information.
Recently at a rehearsal studio I had to walk out to the front desk and ask them for a microphone as there were now in the room. The guy at the desk said that they had to start keeping the mics at the front desk cos they went missing. He asked me to sign it out and also give him some information for a "band profile". I said "Sure", so I gave him my name, phone number, band name, band website address. Then he said, "Now I just have to take a scan of your drivers licence"
I automatically I was kinda shocked and said "What?". I then asked "Sure, then in that case can I see a copy of your privacy policy?"
He then said "Why? We don't have one of those"
Me: "Well you will have a copy of my personal information and I wish to know how it will be used and also stored as I don't wish for it to be stolen or misused. You already have my band name which is actually a registered business name"
He was somewhat stunned that I was even worried about him having a copy of my drivers licence.
He then went on to say scoffing
"This isn't communist Russia"
Me: "No it is a business, and as a business that wishes to store peoples personal information you have a responsibility to inform your customers on how you store their information"
As you can probably tell from his general demeanor and my crazy desire to protect my personal information I didn't end up with a microphone (I had one already but I generally use two). But it made me think of the numerous naive musicians before me who were more than willing to hand over enough personal information that would allow anyone to access perhaps their bank account and make a sizable withdrawl.
Since facebook has constantly spat in the face of peoples right to protect their personal information and intellectual property, people seem more and more willing to simply hand it over to anyone.
P.S. That rehearsal studio no longed gets my business and I emailed them a copy of a Privacy Policy template that they could modify to use. The reply I got was less than thankful.
This is the response I received this morning, after writing them last night:
"Thank you for writing to us and we understand your concerns about the
section of our new TOS that talks about the licenses we need to run Dropbox.
We want to be 100% clear that you own what you put in your Dropbox. We don't
own your stuff. And the license you give us is really limited. It only
allows us to provide the service to you. Nothing else.
We think it's really important that you understand the license. It's about
the permissions you give us to run the service, things like creating public
links when you ask us to, allowing you to collaborate with colleagues in
shared folders, generating web previews or thumbnails of your files,
encrypting files, creating backups... the basic things that make Dropbox safe
and easy to use. Services like Gmail, Google Docs and others do the same
thing when they get these permissions (see, for example, section 11.1 of
Google's TOS).
We wish we didn't have to use legal terms at all, but copyright law is
complicated and if we don't get these permissions in writing, we might be
putting ourselves in a tough spot down the road. As we state in the TOS,
"This license is solely to enable us to technically administer, display, and
operate the Services." We only require this to provide the features of
Dropbox, and this license provides us the ability to do so. We think this
is fair and strikes the right balance.
Thank you for writing to us and please let us know if you have any
additional questions. Understanding your concerns helps us make Dropbox
better.
Thank you."
@pranafire: that's a copy & paste from their blog entry. Looks like they're in damage-control mode now.
The problem IMHO is this: while they may say that their _intent_ is that they "don't own your stuff", that's not what the TOS actually _says_. Besides being horribly vague, the TOS says --oh, nevermind, just re-read the first black-italicized text in CR's post. That does not say "we don't own your stuff." It says the opposite.
If anyone besides myself is wondering how to purge files from DropBox for good (remember that a backup and versioning mechanism is one of its features), it looks like the answer is here: https://www.dropbox.com/help/40?ss=1&ft=help
--Adam
Logical and Legal are NOT the same thing.
Like, Adam, I don't care what they say (outside of the contract) what their intentions are, it's only what it's in the contract that counts. And like Chris said, their intent seems fine right now, a future owner of dropbox could interpret that contract differently. The contract was carefully constructed by lawyers. The wording is not an accident.
The smartest people in law school usually end up in Intellectual Property because it's too complex even for most lawyers to understand.
I'm not sold on losing sleep over this. I mean, I'll use a different service if they don't change some of the more obvious flaws in their TOS. But I don't necessarily think the change is a result of Dropbox's Monthly Let's Fuck Everyone lawyer only symposium. Feel free to tell me I don't know anything about lawyers ; )
Chances are, they got sued by someone for something ridiculous, threw together a knee jerk TOS to cover anything they could ever possibly be sued for, and accidentally pissed all of us off.
I just got home and opened my email:
http://usera.imagecave.com/thesimulacre/That was quick.JPG
Maybe this was addressed, but I'm only now catching up on the comments.
I just go the email too. I agree that the term "Reasonable" is too open to interpretation. I wrote them a response stating that, under these terms they could argue that in order for them to "reasonably" run the service they need to sell advertisements. This TOS would allow them to use any photos (private or shared publicly) in those advertisements ala Facebook's hijacking of photos for ads with friends.
I also agree with the opinion that generally, I expect dropbox to behave appropriately. But then Facebook has proven over and over again that there is risk in a trust relationship and TOS is the only protection consumers may have and that - as others have argued - is a thin blanket if you don't have the money needed to make a real fight in court.
http://blog.dropbox.com/?p=867
Per meeglosh's link above, it seems they revised the ToS wording yesterday, seemingly clarifying it greatly and removing most of the legalese. Looks much better to me, but I'm no expert. Curious to hear what others think.
Yeah, it's in good shape now. No complaints any more.
-CR
Comments are closed on this post.