ie8 fix

Between the Lines

Larry Dignan, Andrew Nusca and Rachel King

Google's mistake leads to a lot of collected Wi-Fi payload data via Street View

By | May 14, 2010, 2:31pm PDT

Summary: A mistake by an engineer caused Google to inadvertently collect Wi-Fi payload data via its Street View cars. An audit turned up the problem.

Google said Friday that an audit showed that it was collecting Wi-Fi data, including sites consumers visited, from its Street View cars that compile data for Google Maps and other services.

In a blog post
, Google said that the data protection authority (DPA) in Hamburg, Germany asked for the audit. Since the request, Google looked at all the data it was collecting. Google initially said that it collected public SSID data and MAC addresses but didn’t grab information sent over a network. However, Google realized it was collecting payload data even though it never used it in a product.

Usually, Google only got fragments of payload data—sites you visit and other items—because Street View cars were on the move.

Add it up and it’s a big mistake:

In 2006 an engineer working on an experimental Wi-Fi project wrote a piece of code that sampled all categories of publicly broadcast Wi-Fi data. A year later, when our mobile team started a project to collect basic Wi-Fi network data like SSID information and MAC addresses using Google’s Street View cars, they included that code in their software—although the project leaders did not want, and had no intention of using, payload data.

As soon as we became aware of this problem, we grounded our Street View cars and segregated the data on our network, which we then disconnected to make it inaccessible. We want to delete this data as soon as possible, and are currently reaching out to regulators in the relevant countries about how to quickly dispose of it.

Oops.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic.

Disclosure

Larry Dignan

Larry Dignan has nothing to disclose. He doesn’t hold investments in the technology companies he covers.

Biography

Larry Dignan

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic. He was most recently Executive Editor of News and Blogs at ZDNet. Prior to that he was executive news editor at eWeek and news editor at Baseline. He also served as the East Coast news editor and finance editor at CNET News.com. Larry has covered the technology and financial services industry since 1995, publishing articles in WallStreetWeek.com, Inter@ctive Week, The New York Times, and Financial Planning magazine. He's a graduate of the Columbia School of Journalism and the University of Delaware.

For daily updates, follow Larry on Twitter.

37
Comments

Join the conversation!

Just In

RE: Google's mistake leads to a lot of collected Wi-Fi payload data via Street View
piousmonk 15th Nov
@keitha73

Yeah, you might be glad it was Google, except for the fact that Google made this info freely availably to those with malicious uses in mind, if I recall correctly.
0 Votes
+ -
In other words, they got caught
AllKnowingAllSeeing 14th May 2010
so it suddenly becomes "a mistake that they'll rectify".

Germany asked, so now they have to get rid of it all before anyone else asks.
0 Votes
+ -
Wifi
MoeFugger 14th May 2010
Had no idea they were doing more than taking photos.
Now I am glad they missed my street.
0 Votes
+ -
"Do no evil"
hickum 14th May 2010
But if you do, call it an accident.

Where's Garrett Rogers on this one?
0 Votes
+ -
Something tells me
Cylon Centurion 15th May 2010
They're only doing this cause they got caught, and that they know they were doing it.
I think they could have easily obscured data from external auditors and that this type of discovery is the whole point of an audit.
@NStalnecker
First of all rate of entropy is directly proportional to the company size. Applies universally.
And then - they collected some unencrypted traffic on the street. So what? It is like picking through garbage left at the curb. Whatever leaves your residence/business and ends up floating down the street is a fair game. And they did not use taxpayers $$ to finance it. NBD.
So some foolish people's Wi-Fi was left unsecured, Google came along and took a snapshot of the connection details and some user data.
Instead of covering up, obfuscating, denying, and all the tricks that other companies get up to when caught in the wrong, Google fest-up and attempts to rectify the wrong.
We all know other companies that would have acted much differently.
0 Votes
+ -
Really? Odd that it took the German inquireries to
AllKnowingAllSeeing 16th May 2010
make Google admit that they were collectingf data, and will now "do something about it".

BTW: How many other companies were logging this information?
0 Votes
+ -
Irrelevant
Tim Patterson 16th May 2010
@Agnostic_OS

Unsecured and foolish or not this is unacceptable.

Google claims it was inadvertent. They had the hardware and the software running to do this and it was inadvertent?

Google has just shot themselves in the foot. Unfortunately Ballmer probably has a huge smile on his face and the MS friendly press will ride this story for as long as they can.

Google has left no doubt that they can't be trusted.

New, more aggressive privacy protections are sorely needed here in the US.
@Agnostic_OS Google fested up about what? They got caught. And then they attempted all the things that you said other company's do.

Also, what attempts did they make to rectify the issue? Did they reimburse the affected people? They didn't do anything beyond trying to protect themselves.
@Agnostic_OS
No, Google collected secure and insecure network data and they said they were not doing so. But the Germany authorities knew better and requested an audit. Google knew they were caught and quickly owned up to it being a mistake. So, no audit, no own up. No audit, no mistake. Yes, sounds like Google is just as bad as the rest, or even worst.
@Agnostic_OS Confessed=to admit wrong-doing. Slang= fessed-up, not fest-up
@Agnostic_OS

Yes, bring other companies into the mix, that will make it all better, even though Google didn't act all that much differently. Google didn't exactly fess up. First it was "we only collected SSIDs and MAC addresses", then it became "oops, it appears we actually did collect payload info, but it's OK, we deleted it (well, most of it, but we'll get around to the rest of it someday". And now it's "Look, it's all better. You can opt out, just muck up your cool SSID with our naming convention, then go to every device you own and edit your WiFi profile."

And it doesn't appear that they've taken any measures to actually notify any of the actual owners of these WiFi networks, so apparently these people also have to read the right tech blogs and news sites to even know their data was harvested, let alone that there's a way they can opt out.
0 Votes
+ -
You want to delete the data?
wcallahan@... 17th May 2010
"We want to delete this data as soon as possible, and are currently reaching out to regulators in the relevant countries about how to quickly dispose of it."
Why the heck don't you just delete it then. Why wait to "reach out to regulators"?
In spite of what they are telling us, it wasn't an accident. Did you think a street view car only has a camera? Why would it need a wifi receiver and a means of storing the intercepted wifi data if that wasn't their goal to begin with?
Im just saying.....
0 Votes
+ -
"We want to delete this data as soon as possible, and are currently reaching out to regulators in the relevant countries about how to quickly dispose of it."

For all it's technological might. It seems that Google does not know how to delete data.

C'mon, it's not toxic waste! Just delete the data and scrub the HDDs.

According to them the data is already quaranteened.
0 Votes
+ -
They probably can't
LarsDennert 22nd Jul 2010
@rarsa You don't delete evidence in an ongoing investigation otherwise you are accused to destroying evidence and covering it up. You can delete it only once.
@LarsDennert My thoughts exactly. You would have to be a complete moron to try and delete evidence during an investigation.

I have to say for a tech blog some of the posters here sure seem stupid!
Read the blog post linked in the article, the reason they are reaching out to regulators to delete the data is so a third party has their hands on the deletion process. Primarily so that everyone doesn't freak out and claim google didn't delete anything at all.
0 Votes
+ -
They ADMITTED they did not know?????
catbirdee 17th May 2010
They actually ADMITTED that they didn't know??? The only thing scarier than them actually DOING it, is thinking we're STUPID enough to believe it was an accident!!! Admitting that they "didn't know" says volumes about either their integrity or their competence!! Good-Bye Mr. Google!
0 Votes
+ -
Most companies will have multiple backups, off site backups, replicated copies.
I would have a hard job after a few weeks with a small business of just one of me and several servers, backups and replications to remove a few files. What on earth do you do with backup tapes? You cannot restore them, remove the data, and then backup minus the wrongful data.
0 Votes
+ -
Why the reactive mode
TxM2xTx 17th May 2010
It sounds Google collected that data in an illegal way. So why does Google have to wait before they can delete the data. Just remove it. Unless you're trying to provide opportunity to governments/other companies to use that data. Is that what they're trying to do ? Sell that data ?
0 Votes
+ -
permission
inkwell 17th May 2010
It is kind how I used to operate as a teen.
I was far easier to be forgiven after the fact than to get permission beforehand.
I'm sorry, we didn't mean to collect your private data... huh?

Google's in the business of collecting and processing private data.

wcallahan is right. Why do they need to collect homeowner's SSID and MAC addresses? Why do they need Wi-Fi collection to take pictures.

I don't know about you, but I don't want my private wireless SSID and MAC address collected by Google or anyone else. That's why I don't broadcast my SSID have layers of security on my home wireless network. It's also why I rarely use Google for Internet searches, except for certain topics and as a last resort.

First, do no... covert collecting of private data.
@rarsa, maybe its an issue of knowing what level of scrubbing these countries require to ensure that the data is erased to their liking. nothing worse then doing a job only to find out it wasn't enough. Get it right the first time. Its probably a significant number of hard drives used to store this data and not something you want to do twice.

As the saying goes, "Measure twice, cut once."
I think that it is great that Google found this inadvertent collection of private data through their street-sweeping tours and tells the public. So the individually run Wi-Fi networks will be alerted of the danger of their data being stolen by cyber-thieves with mobile data-stealing technology.
Just secure your network and you won't have to worry.

If you leave it unsecured, don't whine. Its your own fault. Just be glad it was Google collecting the data and not someone with malicious uses in mind.
@keitha73

Yeah, you might be glad it was Google, except for the fact that Google made this info freely availably to those with malicious uses in mind, if I recall correctly.
0 Votes
+ -
I suppose Google gathers the Wi Fi IDs...
Roque Mocan 17th May 2010
... so they can pinpoint your location by the Wi Fi IDs your device detects. There is already a company in the US that does that and the people at Apple pay to this company so the Apple iPhone can get its location (apart from the GPS).
It's tricky to understand how hard it can be to delete data in a replicated cloud. It is, by its nature, designed to not lose information.

Google probably wants regulaters involved before deleting the data. It would seem extremely difficult for an outside entity to verify that, what amounts to a few molecules of information in a vast cloud of storage, was really deleted unless they participate in the process.
Interesting idea to collect wifi and physical location information. Especially, if someone could figure out what the ISP's IP address was at that location. It would enable some interesting location features that didn't require GPS or cellphone chips. Or, it could enable geo-locating ip addresses down to the neighborhood. I could totally understand why some of their engineers might think it wasn't a bad idea to collect and retain this information.

In response to people baulking at deleting data:
It's tricky to understand how hard it can be to delete data in replicated cloud storage. It is, by its nature, designed to NOT lose information. Google may be able to segregate data easily because that's already built into the storage (e.g. gmail data is isolated), but if it was easy for someone to type delete *.*, then horrible mistakes would happen.

Besides, Google probably wants regulators involved before deleting the data. It would seem extremely difficult for an outside entity to verify that, what amounts to a few molecules of information in a vast cloud of storage, was really deleted unless they participate in the process from the start. It seems easier to hide it than really delete it.

In fact, if Google really had something to hide, they would NOT have allowed auditors to find the stuff in the first place. They aren't dumb and hiding anything in the massive amount data that street view collects should have been easy.

Clearly, they let auditors have access because they thought everything was legit. The auditors found issues. Now, Google is being transparent about how things got into this state and how they are going to fix it. That's kind of the whole point of having an audit. The "they got caught" attitude just don't make sense. This isn't the same thing as a financial audit.. there's no money trail to follow.

If anything, the fact that external auditors were allowed this level of access and uncovered a real issue seems like a good indicator that Google is trying to do the right thing. And their "don't be evil" slogan seems to be working since we hold them to a higher standard than most other large corporations... which may be why they allowed the audit.
It's just to tempting to see the German wifi password-protection law being driven by this. However, to those who suggest 'fessing up shows Google's innocence, the amount and above all depth of information gathered suggests a detailed wardriving intent: to gather what they did takes pass upon pass of hacking, which cannot possibly be accepted as innocent.
Once again I am glad to have pulled that 500m of network wiring into the walls at the reno.
0 Votes
+ -
Why all the Hassle
jon@... 18th May 2010
OK so Google some how has a small snapshot of some data that was transmitted from an unsecured Wi-Fi access point So its unlikely to contain State secrets. Its a small snapshot taken by a moving car so probably only a few seconds. Probably of little use to any one. Google have not said they are using this information infact the opposite. If they were using this information then there would we something to shout about but they have far better ways of collecting information. Millions of people trust them with their emails and their search information. I can see the point of collecting the location of wi-fi access points (using their MAC address) as it makes location aware applications possible for devices without requiring a GPS (which doesn't work inside a building and requires significant power). Millions of people find this useful, and it is only receiving the mac address - it is not using the persons wi-fi or listening into its data. A very sensible and clever solution to a problem which we ought to be thanking Google for performing such a worthwhile task ( Yes I now it helps them better target the adverts - we are getting the adverts whether we like them or not so lets have interesting ones!)

Lets start worrying about the Bad guys who are really stealing our data at our expense.
You can't sell your company and keep control. Google is now a public company, and plays to the same rules as all others. They bought the squeaky clean image as an exploitable asset.
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat
0 Votes
+ -
RE: Google's mistake leads to a lot of collected Wi-Fi payload data via Street View
jackson1984-24316069205748857739440257893812 11th Oct
Your website online nfl jersey is incredibly attention-grabbing. I am loving each 1 of your information you take place to become sharing with any individual!

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix