Feeds

Google: Street View spycars did slurp your Wi-Fi

'Quite simply, it was a mistake' snivels ad colossus

Seven Steps to Software Security

Google has said that its world-roving Street View cars have been collecting information sent over open Wi-Fi networks, contradicting previous assurances by the company.

This means that Google may have collected emails and other private information if they traveled over Wi-Fi networks while one of the cars was in range. Previously, the company said no payload data was ever intercepted.

In a blog post published on Friday afternoon, the company said that it collected the data by "mistake" and that the data has not been used in any Google products. Street View cars have now been grounded, according to the post, and the company has promised to delete the data. But before doing so, it will be asking regulators in "the relevant countries" how this should be done.

Google declined to comment on the matter, instead pointing us back to its blog post. It arrives less than three weeks after the company said that such data was not being collected. But since then, Google conducted a review of the data being collected by its Street View cars after the data protection authority (DPA) in Hamburg, Germany requested such an audit.

Ginger McCall, a staff counsel with the Electronic Privacy Information Center (EPIC), a public watchdog, calls the data collection a "violation of customers' trust," and she questions Google's claim that it was collecting the data by mistake. "People need to ask why was Google was collecting this information," McCall told The Reg. "It's difficult to believe that this would be done accidentally.

"This really flies in the face of their assertion that customers should just trust them."

On April 27, in response to a complaint from the German DPA, a Google blog post said that in scanning open Wi-Fi networks its Street View cars were collecting only the SSIDs that identify the networks and MAC addresses that identify particular network hardware, including routers. Google uses this data in products that rely on location data, such as Google Maps.

But the company now says that when Street View cars began collecting this data, it accidentally included some additional code with the cars' software. "So how did this happen? Quite simply, it was a mistake," today's blog post reads. "In 2006, an engineer working on an experimental Wi-Fi project wrote a piece of code that sampled all categories of publicly broadcast Wi-Fi data.

"A year later, when our mobile team started a project to collect basic Wi-Fi network data like SSID information and MAC addresses using Google’s Street View cars, they included that code in their software — although the project leaders did not want, and had no intention of using, payload data."

There's some question whether Google was violating US wiretap laws by collecting such data. Federal wiretap law criminalizes interception of communications only if it was intentional, and that requirement is generally read fairly strictly, said Jennifer Granick, a senior staff attorney for the Electronic Freedom Foundation.

Google is "saying it's an accident and that may be a good enough excuse to get them out of the wiretap liability," she told The Register. If an inquiry "confirms what they're saying, then there's not criminal intent, but they may still be subject to criminal investigation."

Most state laws carry the same requirement, although laws in many part of Europe may be stricter.

As EPIC's McCall says that Google's admission undermines trust in the company, Google seems to acknowledges as much. "Maintaining people’s trust is crucial to everything we do, and in this case we fell short," the company says.

In response, the company says it will ask a third party to review the its Wi-Fi data collection software and to confirm that it deleted the data appropriately. It also says it will review its "procedures to ensure that our controls are sufficiently robust to address these kinds of problems in the future."

Separately, the company will soon offer SSL encryption for its core search service. In July 2008, Google added an HTTPS-only option to its Gmail email service, and in mid-January, just after announcing that alleged Chinese had nabbed intellectual property from its internal systems, it turned on SSL by default.

"This incident highlights just how publicly accessible open, non-password-protected Wi-Fi networks are today," the company said. "Earlier this year, we encrypted Gmail for all our users, and next week we will start offering an encrypted version of Google Search."

It also offers SSL as an option with its Calendar, Docs, and Sites services, and just recently, it began doing the same with Google Web History and Google Bookmarks, after a security vulnerability was found in the search personalization service that taps Web History.

Yahoo and Bing have yet to offer encrypted versions of their services, except when users are logging in.

Google says that following today's admission, its Street View cars will stop collecting Wi-Fi data entirely, including SSIDs and MAC addresses. But presumably, they will not stop collecting photos of every street on the planet and posting them online. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.