Feeds

Google KNEW Street View cars were slurping Wi-Fi

Wheels fall off 'one rogue engineer' claim

The essential guide to IT transformation

Google knew its Street View cars were slurping personal data from private Wi-Fi routers for three years before the story broke in April 2010.

When the revelations were made, Google said its map service's cars were merely collecting SSIDs and MAC addresses. The following month, it said network data had been captured, but this was the work of one engineer.

Six months later Google conceded that payload data, including emails and passwords, was recorded by the roving photo-motors – but still blamed a rogue engineer.

An investigation by the Federal Communications Commission leaves no ambiguity: an engineer discussed the collection of the personal data with a senior manager, and that between May 2007 and May 2010, wireless traffic was captured by Street View cars.

“Are you saying that these are URLs that you sniffed out of Wi-Fi packets that we recorded while driving?” asks the manager, a question the engineer affirms. Both identities are concealed: the developer is referred to as "Engineer Doe".

The FCC released the full report [PDF, 4.5MB] on Saturday.

Google argued that the interception of payload data from unsecured wireless networks does not breach the Wiretap Act. The eavesdropping was not necessarily unlawful, the FCC accepts, and could not find evidence that Google had used the stored data illegally.

However, the regulator concluded that Google hobbled its investigation and fined it $25,000 for non-compliance. That's rather less than the $8.5m paid out to settle private suits over its now-abandoned Google Buzz service.

“For many months, Google deliberately impeded and delayed the bureau’s investigation by failing to respond to requests for material information and to provide certifications and verifications of its responses,” the FCC wrote.

Google asked a third-party to examine the code, and that technical report has is now publicly available. It confirms that data frames were captured from unsecured networks, and SSID and MAC addresses captured from all Wi-Fi networks found by the Kismet packet-sniffing software.

The ability to capture payload data was outlined in a design document – clearly described as “information about what they were doing”. But Engineer Doe decided that it was not a privacy concern because the Street View cars would not be “in proximity to any given user for an extended period of time” (phew) and that “[n]one of the data gathered would be presented to end users of [Google services] in raw form”.

The engineer added “discuss privacy considerations with privacy counsel” on his to-do list, but despite a line-by-line internal review of the code, no meeting ever took place.

A senior manager at Google told the FCC he pre-approved the design document before it had been written.

Google co-founder Sergey Brin recently confessed a fascinating desire to The Guardian newspaper: “If we could wave a magic wand and not be subject to US law, that would be great. If we could be in some magical jurisdiction that everyone in the world trusted, that would be great. We're doing it as well as can be done."

You can see why. Google’s rap sheet [PDF, 60KB] grows by the day – and details an impressive list of the company’s ongoing litigation on privacy, market abuse and IP abuse charges. ®

Bootnote

The FCC doesn't outline what procedures Google is taking to ensure employees and managers take greater responsibility for privacy sensitive work. The New York Times reports that Google is offering employees courses in "mindfulness" – devised by a Google engineer. Steps include "self-knowledge" and "self-mastery".

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.