there are ways to demonstrably violate terms of service without having access to a user's unencrypted data