Feeds

Google KNEW Street View cars were slurping Wi-Fi

Wheels fall off 'one rogue engineer' claim

The Essential Guide to IT Transformation

Google knew its Street View cars were slurping personal data from private Wi-Fi routers for three years before the story broke in April 2010.

When the revelations were made, Google said its map service's cars were merely collecting SSIDs and MAC addresses. The following month, it said network data had been captured, but this was the work of one engineer.

Six months later Google conceded that payload data, including emails and passwords, was recorded by the roving photo-motors – but still blamed a rogue engineer.

An investigation by the Federal Communications Commission leaves no ambiguity: an engineer discussed the collection of the personal data with a senior manager, and that between May 2007 and May 2010, wireless traffic was captured by Street View cars.

“Are you saying that these are URLs that you sniffed out of Wi-Fi packets that we recorded while driving?” asks the manager, a question the engineer affirms. Both identities are concealed: the developer is referred to as "Engineer Doe".

The FCC released the full report [PDF, 4.5MB] on Saturday.

Google argued that the interception of payload data from unsecured wireless networks does not breach the Wiretap Act. The eavesdropping was not necessarily unlawful, the FCC accepts, and could not find evidence that Google had used the stored data illegally.

However, the regulator concluded that Google hobbled its investigation and fined it $25,000 for non-compliance. That's rather less than the $8.5m paid out to settle private suits over its now-abandoned Google Buzz service.

“For many months, Google deliberately impeded and delayed the bureau’s investigation by failing to respond to requests for material information and to provide certifications and verifications of its responses,” the FCC wrote.

Google asked a third-party to examine the code, and that technical report has is now publicly available. It confirms that data frames were captured from unsecured networks, and SSID and MAC addresses captured from all Wi-Fi networks found by the Kismet packet-sniffing software.

The ability to capture payload data was outlined in a design document – clearly described as “information about what they were doing”. But Engineer Doe decided that it was not a privacy concern because the Street View cars would not be “in proximity to any given user for an extended period of time” (phew) and that “[n]one of the data gathered would be presented to end users of [Google services] in raw form”.

The engineer added “discuss privacy considerations with privacy counsel” on his to-do list, but despite a line-by-line internal review of the code, no meeting ever took place.

A senior manager at Google told the FCC he pre-approved the design document before it had been written.

Google co-founder Sergey Brin recently confessed a fascinating desire to The Guardian newspaper: “If we could wave a magic wand and not be subject to US law, that would be great. If we could be in some magical jurisdiction that everyone in the world trusted, that would be great. We're doing it as well as can be done."

You can see why. Google’s rap sheet [PDF, 60KB] grows by the day – and details an impressive list of the company’s ongoing litigation on privacy, market abuse and IP abuse charges. ®

Bootnote

The FCC doesn't outline what procedures Google is taking to ensure employees and managers take greater responsibility for privacy sensitive work. The New York Times reports that Google is offering employees courses in "mindfulness" – devised by a Google engineer. Steps include "self-knowledge" and "self-mastery".

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.