Google knew its Street View cars were slurping personal data from private Wi-Fi routers for three years before the story broke in April 2010.
When the revelations were made, Google said its map service's cars were merely collecting SSIDs and MAC addresses. The following month, it said network data had been captured, but this was the work of one engineer.
Six months later Google conceded that payload data, including emails and passwords, was recorded by the roving photo-motors – but still blamed a rogue engineer.
An investigation by the Federal Communications Commission leaves no ambiguity: an engineer discussed the collection of the personal data with a senior manager, and that between May 2007 and May 2010, wireless traffic was captured by Street View cars.
“Are you saying that these are URLs that you sniffed out of Wi-Fi packets that we recorded while driving?” asks the manager, a question the engineer affirms. Both identities are concealed: the developer is referred to as "Engineer Doe".
The FCC released the full report [PDF, 4.5MB] on Saturday.
Google argued that the interception of payload data from unsecured wireless networks does not breach the Wiretap Act. The eavesdropping was not necessarily unlawful, the FCC accepts, and could not find evidence that Google had used the stored data illegally.
However, the regulator concluded that Google hobbled its investigation and fined it $25,000 for non-compliance. That's rather less than the $8.5m paid out to settle private suits over its now-abandoned Google Buzz service.
“For many months, Google deliberately impeded and delayed the bureau’s investigation by failing to respond to requests for material information and to provide certifications and verifications of its responses,” the FCC wrote.
Google asked a third-party to examine the code, and that technical report has is now publicly available. It confirms that data frames were captured from unsecured networks, and SSID and MAC addresses captured from all Wi-Fi networks found by the Kismet packet-sniffing software.
The ability to capture payload data was outlined in a design document – clearly described as “information about what they were doing”. But Engineer Doe decided that it was not a privacy concern because the Street View cars would not be “in proximity to any given user for an extended period of time” (phew) and that “[n]one of the data gathered would be presented to end users of [Google services] in raw form”.
The engineer added “discuss privacy considerations with privacy counsel” on his to-do list, but despite a line-by-line internal review of the code, no meeting ever took place.
A senior manager at Google told the FCC he pre-approved the design document before it had been written.
Google co-founder Sergey Brin recently confessed a fascinating desire to The Guardian newspaper: “If we could wave a magic wand and not be subject to US law, that would be great. If we could be in some magical jurisdiction that everyone in the world trusted, that would be great. We're doing it as well as can be done."
You can see why. Google’s rap sheet [PDF, 60KB] grows by the day – and details an impressive list of the company’s ongoing litigation on privacy, market abuse and IP abuse charges. ®
The FCC doesn't outline what procedures Google is taking to ensure employees and managers take greater responsibility for privacy sensitive work. The New York Times reports that Google is offering employees courses in "mindfulness" – devised by a Google engineer. Steps include "self-knowledge" and "self-mastery".
Sponsored: Webcast: Ransomware has gone nuclear