Yes and no.
Absent a proxy or other measures, the destination service (Dropbox, say) doesn’t really know who or where you are. They know the email address and whatever else you provided at signup. Your IP address provides them with some information about your location, but they never really know how reliable that is, and often it’s quite misleading. Tying a file on Dropbox to a specific person or physical address would require information from both Dropbox and the source ISP. Law enforcement can and will request that info if they want it; whether or not they get it depends on Dropbox’s policies and the location of the source ISP. (I’m using Dropbox as an example, the same deal applies to any other web service).
In other words: under normal circumstances your ISP could tell that you’re accessing Dropbox, if they want, but generally[sup]1[/sup] not which account or files you’re using. Dropbox knows your apparent IP, which tells them which network you’re on, and gives some indication of where you are, but they can never be sure how accurate that is. Only someone with the resources to extract information from both Dropbox and the ISP can tie one account to the other.
Using a regular proxy will sometimes hide your true IP address from Dropbox. If it’s a SSL-encrypted proxy, it will certainly make it harder for your ISP to know that you are accessing Dropbox (but may not make it impossible). And, encrypted or not, it will at least decrease the certainty Dropbox has about the location of your computer, and may obscure it to them entirely. But as far as law enforcement is concerned, all you’ve done is increase the number of places they need to extract information from two to three: first Dropbox, then the proxy, then the source ISP.
It might be that Dropbox, or the proxy, or the ISP refuses to hand over that information, or doesn’t log it in the first place. Maybe they’re in a different jurisdiction and the warrant isn’t valid. But you can never really know who is logging what. And each of those services is required to comply with the law in their respective locations - when the law says to hand over the logs, it’s not optional. If your life depends on it, you don’t want to have to rely on unknown and untrusted third parties to maintain your security. That’s especially true of free proxies, open wi-fi and the like: in fact some of them are run with the express purpose of compromising the security of those who use them.
You can chain proxies of course. But again, all you’re doing is increasing the number of sources from which your adversary must extract information, from three to four or five. Each added proxy decreases reliability, and increases the chance you’ve picked one that is compromised. If your adversary is incompetent or doesn’t have the resources to extract information from an overseas proxy, then one secure offshore proxy may well be enough, assuming you trust them.
Your next step would be to use TOR. In a nutshell, this automates the process of chaining your traffic through multiple proxies. It uses cryptographic techniques to ensure that each proxy in the chain knows nothing more than where to route the traffic for its next hop. It’s specifically designed so that even if most of those proxies are hostile or compromised, they still can’t determine the source and destination of the traffic. And, while there are no doubt some TOR nodes run specifically to help compromise traffic, the genuine operators are careful not to log any details of the traffic they carry, as a matter of self-preservation. Given no other means of investigation, tracing traffic through TOR is essentially impossible[sup]2[/sup].
So really it comes down to your threat model, and how well resourced your adversary is. If they only know the name of a dropbox account or file, and they have no idea at all who is accessing it, their chances of passively tracing activity back to one of several billion potential suspects is relatively low to begin with, and essentially zero if you correctly use TOR. Note that this doesn’t mean you’re untouchable; it only means that you can’t be traced by passive monitoring. It doesn’t make you immune to plain old investigation.
-
If you’re not using SSL/HTTPS to use Dropbox, your ISP could log your HTTP traffic, and by examining that may be able to identify the account or files you’re accessing. But that’s too resource-intensive to do as a matter of routine; if it happens at all, it would only be done in response to a request by law enforcement to monitor a specific account’s traffic. And if you’re using SSL/HTTPS, the ISP can’t do that at all; the best they could do is confirm that you’re using Dropbox, and report the times and sizes of requests up and down. The contents of SSL encrypted activity are unreadable to them.
-
If a resourceful adversary wanted to check if a specific known person was accessing a specific Dropbox account, they may be able to correlate traffic from Dropbox and that person’s ISP, regardless of whatever proxies might be in the middle, including TOR. Note that I’m not talking about tracing from Dropbox back to an arbitrary source ISP; I mean when both the Dropbox account and the ISP account are both already known, and they are merely trying to confirm if the two are connected. But if you’re using TOR, at best that will give them a correlation. Not enough to stand up in court. If you’re the world’s most wanted terrorist, on the other hand, and the MIB are at the point where they just need to confirm which of 5 known safe houses you’re using to upload your grocery list, then ever TOR is probably not going to help you.
) so the clandestine downloading wouldn’t attract attention.