File-sharing platforms skip virus scans, yet may be forced to scan for illegal content

Cybersecurity company Surfshark has reviewed popular file-sharing platforms and found that the majority of them don’t scan your files for viruses, nor do they protect you from malicious software on their free plans. 

Meanwhile, the United Kingdom is planning to oblige file-sharing platforms to implement proactive scanning for illegal content. Experts fear this might result in the mass scanning of all files shared between people.

“In our recent study, we found out that highly popular free file-sharing platforms don’t protect your downloaded files from viruses or malicious software (ransomware). I must highlight the fact that viruses and ransomware haven’t gone anywhere — they are still widely used by cybercriminals, and there is a real risk to compromise your devices by downloading infected files,” claims Martynas Dainys, Senior VPN Service Manager at Surfshark.

Box and WeTransfer, which together have a total of 138 million registered users, do not scan for viruses on free plans but begin scanning files on paid plans. Dropbox, with 700 million registered users, does not offer this feature at all. 

Apple’s iCloud, which has 900 million active users, does not scan files during upload or download, but instead relies on Apple device security. While this approach works within Apple’s ecosystem, problems may arise when using iCloud cross-platform. For example, when using iCloud on Windows, it is possible to upload malicious files, which could later be downloaded onto another Windows device.

“Although virus scanning means an additional layer of security, there may be privacy concerns, as automated scan systems have access to user files. On the other hand, if you have an antivirus installed on your devices, you no longer need to worry whether the file-sharing platforms implement additional scanning or not,” points out Surfshark’s expert.

UK plans for mass file and content scanning

Online safety regulations being developed and implemented in real-time by the United Kingdom might elevate proactive scanning to a new level. Relying on the Online Safety Act 2023, the UK is planning to oblige user-to-user platforms — including file-sharing services — to proactively scan and identify illegal and harmful content shared by users. 

“Universal mass scanning of all files shared between people would be an unprecedented expansion of mass surveillance powers. The scale of such scanning would result in many false positives, and innocent people having their content flagged, removed, or even their accounts banned,” claims James Baker, Platform Power and Free Expression Program Manager at Open Rights Group.

He is particularly concerned about how file scanning might impact journalists and researchers who sometimes deal with content that is likely to be flagged. “Would, for example, a picture of police brutality at a protest be flagged as a public order offense?” debates Mr Baker.

There is a risk that some of the scanning technologies could introduce new security vulnerabilities or expose people to new forms of malicious attacks, not to mention privacy violations.

For the complete research material behind this study, click here.