Feeds

Google KNEW Street View cars were slurping Wi-Fi

Wheels fall off 'one rogue engineer' claim

Website security in corporate America

Google knew its Street View cars were slurping personal data from private Wi-Fi routers for three years before the story broke in April 2010.

When the revelations were made, Google said its map service's cars were merely collecting SSIDs and MAC addresses. The following month, it said network data had been captured, but this was the work of one engineer.

Six months later Google conceded that payload data, including emails and passwords, was recorded by the roving photo-motors – but still blamed a rogue engineer.

An investigation by the Federal Communications Commission leaves no ambiguity: an engineer discussed the collection of the personal data with a senior manager, and that between May 2007 and May 2010, wireless traffic was captured by Street View cars.

“Are you saying that these are URLs that you sniffed out of Wi-Fi packets that we recorded while driving?” asks the manager, a question the engineer affirms. Both identities are concealed: the developer is referred to as "Engineer Doe".

The FCC released the full report [PDF, 4.5MB] on Saturday.

Google argued that the interception of payload data from unsecured wireless networks does not breach the Wiretap Act. The eavesdropping was not necessarily unlawful, the FCC accepts, and could not find evidence that Google had used the stored data illegally.

However, the regulator concluded that Google hobbled its investigation and fined it $25,000 for non-compliance. That's rather less than the $8.5m paid out to settle private suits over its now-abandoned Google Buzz service.

“For many months, Google deliberately impeded and delayed the bureau’s investigation by failing to respond to requests for material information and to provide certifications and verifications of its responses,” the FCC wrote.

Google asked a third-party to examine the code, and that technical report has is now publicly available. It confirms that data frames were captured from unsecured networks, and SSID and MAC addresses captured from all Wi-Fi networks found by the Kismet packet-sniffing software.

The ability to capture payload data was outlined in a design document – clearly described as “information about what they were doing”. But Engineer Doe decided that it was not a privacy concern because the Street View cars would not be “in proximity to any given user for an extended period of time” (phew) and that “[n]one of the data gathered would be presented to end users of [Google services] in raw form”.

The engineer added “discuss privacy considerations with privacy counsel” on his to-do list, but despite a line-by-line internal review of the code, no meeting ever took place.

A senior manager at Google told the FCC he pre-approved the design document before it had been written.

Google co-founder Sergey Brin recently confessed a fascinating desire to The Guardian newspaper: “If we could wave a magic wand and not be subject to US law, that would be great. If we could be in some magical jurisdiction that everyone in the world trusted, that would be great. We're doing it as well as can be done."

You can see why. Google’s rap sheet [PDF, 60KB] grows by the day – and details an impressive list of the company’s ongoing litigation on privacy, market abuse and IP abuse charges. ®

Bootnote

The FCC doesn't outline what procedures Google is taking to ensure employees and managers take greater responsibility for privacy sensitive work. The New York Times reports that Google is offering employees courses in "mindfulness" – devised by a Google engineer. Steps include "self-knowledge" and "self-mastery".

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.