The Fourth Amendment:
In the United States, where most of the cloud storage providers are located, the personal information of individuals is protected by the Fourth Amendment:
“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”
Once personal documents are shared with others, they are not protected any more by the Fourth Amendment and can be accessed by the government without the need for a warrant or demonstrating probable cause. This is called the “third party doctrine”. The application of the Fourth Amendment to email or cloud computing has not yet been addressed by the Supreme Court. Without any legal guidelines, uploading files to a cloud storage provider can be considered sharing, the uploaded data then is not considered private anymore:
“However, when the object of a search | tangible or not | is voluntarily turned over to a third party, the Supreme Court has held that a person loses their reasonable expectation of privacy in that object.” [Cou09]
For users storing their files inside the United States (e.g. because they are using Dropbox), the only way to guarantee the privacy of the uploaded data is to encrypt it locally with a personal key before uploading it. The providers can not be trusted to keep the data confidential, since they can be ordered by law enforcement to cooperate with ongoing investigations. As an example, in 2007 the secure email provider Hushmail34
“…modified their product to capture the passwords of the three suspects, which it then used to decrypt the 12 CDs worth of email that it provided to US law enforcement agents.” [Sog09]
