&gt; And you cannot initiate a meaningful query if you are a server-side observer.<p>But that&#x27;s only true if you consider the database in isolation. It&#x27;s a very bad assumption to make when using it as a component of a larger system!<p>Let&#x27;s say you build a social networking service which uses ZeroDB to store its data; I&#x27;m an attacker who has access to the database server. There are all kinds of ways I can gain indirect control over the requests that users make to the service. What if I convince two different users to open a web page containing something like &quot;&lt;img src=&#x27;<a href="https:&#x2F;&#x2F;supersecuresocialnetwork.com&#x2F;friend-list.jsp&#x27;&gt;&quot;" rel="nofollow">https:&#x2F;&#x2F;supersecuresocialnetwork.com&#x2F;friend-list.jsp&#x27;&gt;&quot;</a>? I&#x27;ve just triggered an operation that will cause the app servers to request tree nodes corresponding to those users&#x27; accounts, and those of their friends, at predictable times. I can correlate the requests and determine with some level of confidence whether the users are mutual friends, all without being able to see a single byte of plaintext. If the service is publicly available and I can register my own accounts, that opens up another huge category of attacks.<p>My point is that you&#x27;re making an awful lot of assumptions about what strategy an attacker will use. If you don&#x27;t have provable security against an entire class of attacks (e.g. cryptographic properties like IND-CPA) then the burden is on you to be more imaginative than whoever is trying to compromise your system.