Google Private Data Collection: Company ADMITS Snooping Via WiFi Networks

In a blog post published Friday, Google admitted to 'mistakenly' collecting sensitive private data sent over WiFi networks.

Germany's data protection authority (DPA) requested Google audit the WiFi data collected by its Street View cars. The audit revealed that contrary to the company's claims, for at least three years, Google has been collecting payload data (the information users send over a wireless network) from non-password-protected WiFi networks. A programming error from 2006 was at fault.

Explaining how this collection of sensitive data occurred, Google's Senior VP of Engineering & Research Alan Eustace said, "Quite simply, it was a mistake." He explained, "An engineer working on an experimental WiFi project wrote a piece of code that sampled all categories of publicly broadcast WiFi data. A year later, when our mobile team started a project to collect basic WiFi network data like SSID information and MAC addresses using Google’s Street View cars, they included that code in their software—although the project leaders did not want, and had no intention of using, payload data."

Google outlined the steps it plans to take as a result of the mistake. The company says it intends to delete the data "as quickly as possible." It has already grounded its Street View cars, and will halt collection of WiFi network data.

Additional measures include:

* Asking a third party to review the software at issue, how it worked and what data it gathered, as well as to confirm that we deleted the data appropriately; and
* Internally reviewing our procedures to ensure that our controls are sufficiently robust to address these kinds of problems in the future.

Google tried to mitigate concerns by clarifying that none of the private data was used in Google products and only "fragments" of information were collected.

The admission comes following outspoken criticism from Germany's Federal Data Protection Commissioner Peter Schaar, who was "horrified" to learn that Google's Street View car cataloged private WiFi network data like Mac (Media Access Control) addresses and SSIDs, in addition to snapping pictures of public streets.

Read Google's full blog post here.

Comments

[Christopher Daley]

10:42 PM on 05/18/2010

I knew those stupid people at Google were up to something.

http://www.csdaley.com/2010/05/they-are-watching-you-stupid.html

[eaglewing]

09:06 AM on 05/18/2010

Google is Iying as aIways. A programming error makes programs NOT work or malfunction. They don't 'mistakenly' collect sensitive private data unless collecting data was the purpose of the programmer.

[David Norman]

07:37 PM on 05/19/2010

Right, that is why they are the only internet company to pull out of China rather than continue censoring. As a BI Analyst and Engineer I can also tell you that a coding error that grabs too much information is exactly as easy to make as one that grabs not enough information. There are more programming errors that let programs work but get the data wrong then there are all other programming errors combined. 59 fans, and I have yet to run into a post from you that is even loosely based in fact.

[Louisknyc]

01:38 PM on 05/17/2010

And people worry about Apple. Google is showing its true colors. This is their end game.

[curiousasheck]

12:35 PM on 05/17/2010

"The engineering team at Google works hard to earn your trust—and we are acutely aware that we failed badly here. We are profoundly sorry for this error and are determined to learn all the lessons we can from our mistake."

Oh that's funny. We work hard to earn your trust, by trying to not get caught invading your privacy etc, etc.

[debby6669]

12:32 PM on 05/17/2010

I have to take an anti-anti-Google stand here, meaning that I can't side with Google, but I can't join the anti-Google bandwagon eithere.

Here's the bottom line - if your wireless network is visible, then it's vulnerable to anyone. Yes, you can step up the encryption from WEP to WPA (and you definitely should), but not having it visible at all is really the most important thing.

If someone can't see it, they can't attack it.

As technology evolves, users of technology must become more savvy.

[cmack1024]

01:29 PM on 05/17/2010

kismet says you are a liar, or just plain ignorant;
http://www.kismetwireless.net/

[think-it-over]

02:22 PM on 05/17/2010

Your lack of reading comprehension has prevented you from understanding what she actually said, which makes you the ignorant one (and almost certainly an as whole, too). She didn't say you can make the signal invisible to everyone or that it's impossible for those who are motivated to find signals that aren't broadcasting the SSID. She simply said that if someone can't see it, they can't attack it, and that's completely true (other than attacks that are targeted generally, rather than at a specific gateway).

Obviously it's impossible to broadcast radio waves and make it impossible to detect the signals. It's also impossible to keep somebody from breaking into your house just by locking the front door. What you can do is make sure that there are easier targets out there so that the vast majority of those who might break in will simply move on to easier pickings. Turning off SSID will make your gateway invisible to most people, which will make all of your neighbors who are broadcasting easier targets.

[debby6669]

04:43 PM on 05/17/2010

think-it-over pretty much summed it up. You should read more carefully.

Also, no need to be hostile! The information that I gave was intended to be helpful.

What were YOU doing?

[PenguinLinux]

05:32 PM on 05/17/2010

uh yes, you can attack it - even with a hidden SSID, evne with MAC filtering, even with WEP, WPA, WPA2. MACs can be spoofed, hidden SSIDs found and WEP, WPA, WPA2 can be cracked. the greatest strength (or in your case weakness) is the end-user, their knowledge (or lack thereof) and how they do (or do not) apply it.

[ESLundo]

12:26 PM on 05/17/2010

All reminds me of a novel Red's Query about a mole in a big internet search company spinning privacy profiles to frame folks on a hit list. Hey, I wrote that novel. Doesn't seem so far out there these days.

[Rj5000]

11:55 AM on 05/17/2010

http://www.youtube.com/watch?v=thWm1TuYo6E

[thetransientstranger]

08:34 AM on 05/17/2010

I don't buy that this was a small programming "error" that went unnoticed for this long a period of time. The sad thing is, nothing is probably going to be done by the government to stop these types of transgressions. They (Google and similar corporations) will just say sorry, at most pay a relatively small fine, then find a new way to continue what they were doing.

[David Norman]

07:45 PM on 05/19/2010

Then you are obviously not a programmer. Programs grabbing more info than they are supposed to is perhaps the most common programming error there is, and one of the easiest mistakes to make.

[thetransientstranger]

04:21 PM on 06/01/2010

I wasn't speaking about the fact whether it's possible to have an error like that, what I was speaking about was how it could have gone unnoticed for a number of years. Learn to read English properly before you critisize other people's credibility on more advanced subjects.

[candyer]

10:51 PM on 05/16/2010

thanks for sharing! There are some apps you maybe interest in .
http://www.aneesoft.com/tutorials/ipad/best-20-free-ipad-apps.html

[cosmicrhythmunit]

10:36 PM on 05/16/2010

Gee, we ACCIDENTALLY took street and satellite photos of every home on the planet, and then we ACCIDENTALLY drove by and gathered confidential information on your wi-fi system. But don't worry, our slogan is "Don't be evil." So you're safe.

[StarDagger]

01:37 AM on 05/17/2010

Indeed!

[Steve Gadbois]

04:24 PM on 05/16/2010

Really this is where we draw the line for a company who stores your Internet behavioral data in perpetuity from Gmail, search, toolbars and almost every application they have developed.

[HonestJohnnis]

05:12 PM on 05/16/2010

If you don't want your web browsing behavior to be stored you should stop using the internet.. Hell Apple is even making iads for that very purpose and the kool-aid kiddies are praising it.

[cromag]

03:54 PM on 05/16/2010

Go gather the MACS and/or SSIDs of a bunch of corporate and government networks and see how fast you get nailed for hacking.

[HonestJohnnis]

04:59 PM on 05/16/2010

gathering unencrypted information from wireless networks (ssid and mac addresses) is in absolutely no way hacking.

[cmack1024]

01:33 PM on 05/17/2010

yet people go to jail for this type of behavior, dang! Remember teh corporation is more than a person(all the rights and more, yet no responsibility/liability), so it doesn't have to worry with such trivial things....

[Liona]

03:18 PM on 05/16/2010

I like the conclusion on this article on the same issue - Google Confession. Sure :-)

oops! I Did It Again
http://awesomedc.com/2010/05/15/oops-i-did-it-again/

[KickTheBox]

01:52 PM on 05/16/2010

Mistake? Funny, the cars are sent out to take pictures. Why were they equipped with anything other than cameras? How can they explain that collecting wifi data was a part of taking pictures for street view?

If you want to listen to the radio you don't do it with a camera and vice versa...

[frmadistance]

06:30 PM on 05/16/2010

I know. wtf?

[think-it-over]

02:44 PM on 05/17/2010

Simply collecting basic information *about* the radio signals that are being beamed through your windshield isn't a problem. The problem is when they start to collect content being broadcast by those signals.

Programmers reuse existing code all the time to do things, so I'm willing to believe that they didn't intend to collect all of the information that they did. What I am skeptical about is that they could have collected all that data for a significant period of time without becoming aware of it until government authorities asked for an audit.

What I'd really like to know is what they planned for the data they did intend to collect. I can see the possibility of targeting some advertising based on connecting IP addresses to use of a wireless network, and there's obviously a benefit to indexing locations of wireless networks that are intentionally available to the public. I can't see any legitimate reason to be collecting SSID info, network names, or MAC addresses.

[mrcontinental]

03:00 AM on 05/16/2010

Anyone who believes that any of their online transmissions are private is asking for trouble. Always assume that someone, somewhere, is listening and limit information to the bare minimum.

[frmadistance]

06:30 PM on 05/16/2010

Woo woo alert!

[frmadistance]

06:48 PM on 05/16/2010

btw Im kidding. But it will be fun to watch all the oppressive "woo woo" trolls become woo woos them selves as they finally wake up to what's what.