Feeds

ICO mulls stiffer probe into Google Street View Wi-Fi slurp

Fresh revelations may pave way for some actual punishment

Boost IT visibility and business value

The UK's data protection watchdog may still take enforcement action against Google over its unlawful collection of personal information from unencrypted Wi-Fi networks following the recent publication of a US regulator's report into the matter.

The Information Commissioner's Office (ICO) told Out-Law.com that it is reviewing whether or not to take "further action" against Google as a result of findings detailed in the Federal Communication Commission's (FCC) report [25-page 4.76MB PDF].

In May 2010 it emerged that the cars Google used to photograph towns and cities for its Street View service had also been scanning the airwaves to identify and map Wi-Fi networks. This process resulted in the gathering and storage of data snippets as they passed through the networks. In an initial assessment of the activity in July of that year the ICO declared that it would take no action because it was "unlikely" that Google had gathered much personal data.

However, following investigations by Canada's Privacy Commissioner the ICO decided to reinvestigate. Canadian Privacy Commissioner Jennifer Stoddart had said that entire emails, highly sensitive personal information and even passwords were collected by Google. The company has admitted the claims.

In November 2010 the ICO determined that Google's Wi-Fi data gathering activities had been a "significant breach of the Data Protection Act" but decided not to fine the company. The Data Protection Act provides that it is unlawful to obtain personal data knowingly or recklessly.

Instead the ICO warned of taking "further regulatory action" if Google did not comply with undertakings it agreed to. Those undertakings committed Google to improving its privacy policies and consenting to the ICO conducting an audit of its practices.

In reporting on the outcome of its audit in August last year the ICO said that Google had offered it "reasonable assurance" that it had made changes to how the company addresses privacy issues.

However, the watchdog said it would "study" the FCC's report "and consider what further action, if any, needs to be taken," a spokesperson for the ICO said in a statement.

"Google provided us with a formal undertaking in November 2010 about their future conduct, following their failure in relation to the collection of WiFi data by their Street View cars," they said. "This included a provision for the ICO to audit Google’s privacy practices. The audit was published in August 2011 and we will be following up on it in June to ensure our recommendations have been put in place."

Who knew about the data-sniff software?

The FCC found that a Google engineer intentionally wrote software code that would allow cars the company used to photograph towns and cities for its Street View service to also collect "payload" data from unencrypted Wi-Fi networks the cars came within range of. The software design was pre-approved by a manager at the company. It enabled the gathering of entire emails, usernames and passwords when Google's camera-mounted cars scanned Wi-Fi networks.

The FCC said Google had disclosed details that "revealed that on at least two occasions [the engineer] specifically informed colleagues that Street View cars were collecting payload data". The information also confirmed that the engineer told a senior manager on the Street View project that the software had "sniffed out" the data.

However, the report said "Google's supervision of the Wi-Fi data collection project was minimal". The FCC fined Google $25,000 for "wilfully and repeatedly violating" its requests for responses to its inquiries but said it had "decided not to take enforcement action" against the company. A privacy group has called on the ICO to ensure that it was not misled by Google during its investigations into the matter.

"This incident highlights the shocking attitude towards privacy that runs to the heart of Google's business," Nick Pickles, director of Big Brother Watch, said. "Google deliberately and without remorse spied on people's Wi-Fi networks and has now been caught trying to cover it up and lying about what they did."

"The Information Commissioner should urgently take steps to ensure Google did not mislead him when he investigated this issue in the UK. This episode lays bare Google's main motivation is chasing greater profits on the back of our personal data, with little regard for the legality or ethical concerns of how they capture that information," he said.

Build a business case: developing custom apps

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
EU justice chief blasts Google on 'right to be forgotten'
Don't pretend it's a freedom of speech issue – interim commish
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
This'll end well: US govt says car-to-car jibber-jabber will SAVE lives
Department of Transportation starts cogs turning for another wireless comms standard
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.