Google Says It Mistakenly Collected Wi-Fi Data While Mapping

Even if Google says there's nothing to worry about, newviewmedia.com writes, the company "said it would stop collecting Wi-Fi network data from its StreetView cars, after an internal investigation it conducted found it was accidentally collecting data about websites people were visiting over the hotspots. From the WSJ article: 'It's now clear that we have been mistakenly collecting samples of payload data from open [i.e. non-password-protected] Wi-Fi networks, even though we never used that data in any Google products.'"

Comments

Hey,

[Threni]

they're not called `open networks` for nothing. Tighten up, or shut up. Oh, and postmen read your postcards too.

Re:Hey,

[Mordok-DestroyerOfWo]

An open network, much like an unlocked door or a drunkenly passed out girl is not an invitation for invasion. Granted like most people here I use WPA and don't even broadcast my AP. I agree with you that it is stupid practice, but that doesn't make intrusion morally right.

Re:Hey,

[marcansoft]

It's not a man-in-the-middle attack. They were probably just capturing all WiFi traffic in order to search for hotspots, but forgot to filter it so only beacon frames were stored. A proper set of cards sniffing are much more effective at detecting faint hotspots than just mashing on the "scan" button on one card, which probably discards stray beacons.

It's your fault if you're broadcasting your data all over the airwaves unencrypted where anyone with a passive receiving antenna can pick it up.

Re:Hey,

[dougisfunny]

Well, this is more akin to a drunkenly passed out girl, who passed out on the front lawn, naked, being photographed by the camera's on the street view vehicle.

Re:Hey,

[Anonymous Brave Guy]

Sure, and your sister was asking for it with that dress she was wearing, right?

Fortunately, most of the world is enlightened enough to realise that such statements are absurd, and just because someone is vulnerable to something unpleasant that does not make it their fault if someone else does that unpleasant thing to them.

FWIW, the actions described would probably be criminal and carry jail time if they occurred in the UK (e.g., under the Wireless Telegraphy Act 2006).

Re:Hey,

[marcansoft]

I disagree. An open network is not an invitation to join it and use it (associate), but an unencrypted network is an invitation for anyone to sniff your traffic passively. This would be like satellite TV providers sending their feeds unencrypted and then complaining that non-subscribers are watching their channels. What do you expect if you're broadcasting your data on the air in the clear into public space?

Granted, sniffing everything is not nice of Google (and probably an unintended screwup), but you really shouldn't expect that people won't do it.

Re:Hey,

[Arancaytar]

man-in-the-middle attack

That word does not quite mean what you think it means.

An MITM attack is where you actively intercept a point to point connection, negotiating a secure connection with each end-point while pretending to be the other. It is not feasible to do this to a wifi connection because you can't block the real end-points' reception of each other.

This is just passive sniffing. You can do it on any wifi network, open or not, although you can obviously only read unencrypted data.

Re:Hey,

[Jurily]

And there's a difference between malice and having so many devices it's practically impossible to turn them off all at once.

Re:Hey,

[tagno25]

A MITM can be done on WiFi, but it requires arp poisoning.

Re:Hey,

[Dirtside]

You might be stupid for leaving your network open, just as you might be stupid for leaving your house door open, but it's still not okay to use either one of them without permission. I won't have a lot of sympathy for you, but I'm not going to let the intruder off the hook, either.

Re:Hey,

[jibjibjib]

2. If you read the article, they had included software that collected traffic, like emails, etc.

Yes. As in, they collected /all/ wireless traffic with the intention of checking which hotspot it came from and measure its signal strength. I don't think there's any indication that they specifically tried to log emails or that they did any of this for purposes other than locating hotspots.

Re:Hey,

[icebraining]

1) And just like Google, *anyone* can sniff that data, not just your neighbors. They don't have any special powers, they use the same public anyone else can use.

2) It's called a sniffer. Has GP said, it's much more effective at finding APs, exactly because it finds any packets. Storing the payload may or may not be an accident.

3) That quote is largely taken out of context.

4) First, they are actively protecting their data - why aren't you? Not only you're not protecting it, you're broadcasting it to public space, and you want privacy?
"I'm running naked on the street, how dare people look at my penis?"

I'm no Google fanboy, and I really dislike their Ad-network prevalence, but being offended by this is ridiculous.
Personally, I use a double network system: WPA-Enterprise for my machines, open for anyone else.

Re:Hey,

[nurb432]

Just beacuse you leave your bedroom window open it doesn't give your neighbors the right to walk over and peek in.

Re:Hey,

[Mordok-DestroyerOfWo]

What Ben Roethlisberger does on his own time is his business.

Re:Hey,

[CAIMLAS]

Yeah, but they did it "accidentally". That's like accidentally slipping and putting your dick in someone's vagina: mapping APs and associating the traffic going through them does not occur without intention.

Re:Hey,

[calmofthestorm]

I've personally been to Google Boston and Mountain View and not only was I not searched or even asked if I had a camera, I was told explicitly at Mountain View that photography was permitted outdoors and to please ask first indoors. I was asked not to take pictures in Boston, but again, not searched or asked for camera.

I was at Mountain View about two years ago and at Boston two months ago.

Re:Hey,

[KrugalSausage]

Ah, the thought of comparing a postman reading mail to rape. I wonder what moral relativism will look like for my grandchildren. Oh, and in the UK they arrest you for just about anything these days. I'm sure you know about the guy arrested for saying homosexuality is a sin? http://www.nydailynews.com/news/world/2010/05/03/2010-05-03_gay_cop_arrests_preacher_for_saying_homosexuality_is_a_sin.html

Re:Hey,

[Anonymous Brave Guy]

The law I'm thinking of is actually written rather carefully. It does not criminalise all networking or monitoring broadcasts that would normally be intended for public use. It does criminalise either intentionally obtaining certain types of information or disclosing such information even if it was obtained unintentionally.

I suspect even Google's lawyers would have difficulty arguing that employees of one of the most high-tech companies in the world, driving around in a specially equipped vehicle, with the goal of monitoring and recording transmissions from other people's wireless networks, storing personal messages or other sensitive information, did not breach the "intentionally obtaining" part of the Act.

Re:Hey,

[Anonymous Brave Guy]

Sorry to reply to my own post, but I should correct myself: the law I cited doesn't allow jail time for that particular offence, only a fine. There are other similar offences (e.g., accessing data on a computer without authorization, under the Computer Misuse Act) that do carry jail time, but without talking to a lawyer I don't know if they would apply here.

Re:Hey,

[Anonymous Brave Guy]

Well, firstly, I wasn't talking about the postman reading mail. But in any case, the principle of saying that someone vulnerable to harm is not automatically at fault if someone else then causes that harm is exactly the same, whether we are discussing invasion of privacy, theft from an unlocked car, date rape, or murder with a sniper rifle from 500m. No-one is trying to equate the damage caused by these different offences, but the immorality of the "asking for it" defence is the same in every case.

Re:Hey,

[tomhudson]

The article indicates that the original software was expressly written with logging capability. They somehow "forgot" to remove it. And nobody noticed. For three years!?!

Re:Hey,

[tomhudson]

They were storing the payload for the last 3 years. Three years, and NOBODY noticed? Nobody said "is this even legal in all the places we operate?" Nobody said "Can this come back and bite us on the ass?"

3 years is a long time to "accidentally" be doing something when it's your profession.

Re:Hey,

[Gorimek]

UK Law: ...uses wireless telegraphy apparatus with intent to obtain information as to the contents, sender or addressee of a message ... of which neither he nor a person on whose behalf he is acting is an intended recipient, or

If you read the actual Google blog post, it's made very clear that getting content was not intentional. They're only after IDs and locations of the wifi spots.

You've clearly never worked at any "of the most high-tech companies in the world", if you think this kind of accident couldn't happen in such a place.

Re:Hey,

[Ganthor]

OK Here's my view. Flamebait or not.
Google have repeatedly demonstrated some sketchy regard for privacy of others. They have to be dragged kicking and screaming to implement procedures that allow people to remove street view pictures for example.

I agree that in pushing the envelope that they will come across some interesting social topics like the ones that they found in the first run of street view and the one they are back peddling now. And I do believe in the large amount of good Google have done for open source and data use for the public good, (Google earth and maps for instance).

However Google repeatedly are coy whenever they think about collecting information and get asked for explanations on what they will be doing with it.

In this instance I read a BBC article that indicated that the German government asked to review the data and that's when Google "discovered" this "gaff". It wasn't Google unprompted..

What makes even more sobering reading is Google's own blog which admits they were intending on collecting wi-fi SSID's and MAC addresses.
http://googleblog.blogspot.com/2010/05/wifi-data-collection-update.html
For what purpose, I ask, would MAC addresses be collected?

However officially Google now admit to collecting snippets of payload data which is something they expressly ruled out in the original blog. They say this was a mistake...I have my doubts.

Think it through...They are collecting this data ... the data is 3 years old....did they just sit on it and do nothing with it?
Surely when they started extracting the SSID's and MAC's, they would've noticed the snippets of people emails and websites they also captured...surely the tested the code and the data collected? And then what did they do...Nothing! They didn't exercise any moral judgment and raise the issue of people's privacy on unencrypted networks. They have the platform they could have won some serious brownie points by telling people how to protect themselves. But did nothing. I don't believe they held all this data and didn't know what it was.

This is yet another example of a "mostly good" company collecting peoples personal data for reasons us mere mortals can't understand.

I think there is a real difference between data that is public to your neighbors and then someone posting that data on a billboard in the the main street. For instance, when I'm on holiday perhaps?
Clearly here is an example of data that is not private, in the public domain but is not intended to be distributed to strangers. That level of privacy is not covered by the current laws but needs to be in my opinion.
I could go on but I recon half the people who started reading have stopped already;-), ... suffice to say, I'll be doing less of my searches with Google as a direct result, and ensuring my network is buttoned up even tighter the ever.

Re:Hey,

[klui]

From the link.

...next week we will start offering an encrypted version of Google Search.

That's nice. At least Google should be the ones who gets those stats and not some sniffer in between.

Re:Hey,

[Kilrah_il]

Although some of your points are valid, I think you missed one of the most important issues regarding the entire story: Google were frank about their mess-up.
When we have trouble with privacy with Facebook/MS/Apple/Sony/pick-your-flavor-of-the-month-privacy-issue-culprit you usually have to dig up the info yourself for weeks until you get the company to admit anything was wrong, and then you still have to raise hell to get them to fix the problem (if they can - Sony rootkit fiasco a case in point).
Here Google had many options:
1) They could have found about the error and deleted all information the moment the Germans started inquiring - nobody would have known anything. If asked - do like the politician, deny.
2) They could have issued a short statement claiming that they independently found an error and fixed it, without disclosing too much details.
3) They could have issued a long statement admitting that they started the investigation after the German inquiry, admitting their mistake, their lessons and the steps they took to resolve the issue, including stopping the StreetView WiFi collection project.

I honestly think that Google was as straight-forward and honest as can be admitting their mistake, and that should give them some credit. If their original intent was "evil", I don't think they would have chosen option no. 3.
We keep asking companies to be honest about their practices and mistakes, but when they do admit wrongdoing, we bash them on /. and then promise not to use their services. I personally think that I admire Google for being so honest and will continue using their services, but that's just me.

Oh, and btw, I think it's recommended to read their original blog post - http://googleblog.blogspot.com/2010/05/wifi-data-collection-update.html just to have their side of the story straight.

Re:Hey,

[espiesp]

Ganthor Said: "For what purpose, I ask, would MAC addresses be collected? "

Easy. Google Location Services. By tying a WiFi MAC to a GPS Coordinate you can use wifi as a sudo-gps solution. Even for devices with GPS it's faster and probably lower power to simply bark up the WiFi and look up the MAC of the hotspots around and shut it down. GPS takes a while to lock on in the best of circumstances and in dense urban areas Wifi simply rocks for this purpose.

However, as I discovered when I moved my Wireless Router from Las Vegas to Michigan, it's not without it's issues... Simply manually re-registering my Routers MAC fixed that problem pretty quickly.

Re:Hey,

[Ganthor]

Hey, thanks for your thoughtful reply. I admit to being very suspicious of people in general and large data gathering really makes me want to find a nice and cozy cave to live in.

You are right, they are giving the "honesty is the best policy" impression and for that (regardless of how this all started), they should get some credit.

You also listed a bunch of companies that have been caught collecting data or invading privacy in some way. While you're at it, remember Amazon's latest invasion on the kindle (don't know the product so spelling suspect). Don't you think this problem is becoming a plague?

You know, scientists have to pass all testing related to animal and humans through the Ethics committee (in my country at least). Perhaps these large companies should start doing the same with respect to privacy information? This is such a common issue now, and most of it unbroken ground. - Legislators can't hope to keep up when the envelope is being pushed.

I'm all for the debate and our society needs to evolve with it's new abilities.

Re:Hey,

[khchung]

So I assume you would be OK if Google told you their street view cars also contained sensitive microphones, which just happened to record some dirty jokes you told your friend on the street? And now everyone can get on the street view, see your (blurred) image and click "hear recordings" to hear your dirty joke too, you would be OK with that too? After all, whatever you did in public should be ok to be publicized, right?

Seriously, if you don't think there is something wrong with collecting local and transient data and putting them into a big permanent database correlating with other data, by a private corporation that is best known to profit from large scale datamining, you just haven't thought deeply about the issue.

Re:Hey,

[khchung]

but an unencrypted network is an invitation for anyone to sniff your traffic passively.

So you are OK if, in a restaurant, other patrons eavesdrop and record your conversations with your SO/close friend? It is ok to do so in a public restaurant, right?

Would you also be OK for your neighbor to eavesdrop and record the noises coming out from your house, e.g. you arguing with your SO, or whatever noise coming out of the master bedroom at night? Even though they may need a sensitive microphone or a big parabolic dish to do so, from across the street to your house?

After all, not talking in codes or installing noise absorbing wall in your house is an invitation for anyone to passively listen to your conversations, right? What do you expect if you are broadcasting your sound waves on the air in the clear out into public space? Right?

Re:Hey,

[Anonymous Coward]

Dude calm the frick down. Google is a massive corporation with thousands upon thousands of employees simultaneously working on thousands of projects, using code created over a span of several years by programmers who may have already moved on to another project or left to a different company. It's not inconceivable they would have missed this "feature", especially if it doesn't register as a "bug" that destabilizes their intended operations.

Re:Hey,

[icebraining]

I find that question to be largely irrelevant. In my opinion, they could have stored it indefinitely. People were broadcasting it to the public space, for me that's no different than doing something in the middle of the street.

If people got their routers from their ISPs and they were setup like that, it's the ISP fault, not Google's; I suggest people should sue them. If they bought the router themselves, it's their fault. I don't buy and use an electric wood saw or some other machinery without reading the manual. People expecting to use stuff without learning how is why we have spamming botnets.

Re:Hey,

[Fastolfe]

This is the same google that confiscates all cameras before outsiders are allowed on-campus.

I call bullshit.

Re:Hey,

[RabbitWho]

Hi! Could someone explain to me, 'cause I'm not so tech-savvy, how this can happen unintentionally? Thanks!

Re:Hey,

[Zen Hash]

The article indicates that the original software was expressly written with logging capability. They somehow "forgot" to remove it. And nobody noticed. For three years!?!

Yes, they were capturing wireless traffic to look for access points. What they failed to do was take the time to make sure that it was written to filter out the irrelevant information. This really isn't that complicated. If you want to see what kind of data they were logging, put your wireless interface in monitor mode and start capturing traffic with wireshark. If anyone is transmitting anything on the same channel as your wireless interface and within range of being received by your antenna, it will end up in your capture file. Anything unencrypted will be, well, unencrypted.

Maybe I know my neighbors, so I trust them/know they're not that talented.

I know and trust my neighbors as well, but I still would not knowingly broadcast personal or sensitive information to the entire neighborhood. How can you possibly know that the only people who will hear are your neighbors? Keep in mind that interested parties could listen from much further away depending on their equipment.

Re:Hey,

[asaz989]

In reply to 2: The article actually says "These snippets [802.11 frames] could include parts of an email, text or photograph or even the website someone may be viewing." They're explaining what a frame is for people who don't know, not saying that Google was assembling and tracking e-mail traffic.

Re:Hey,

[obarel]

I leave wireless webcams in public toilets. They're not called "public" for nothing.

An open window is not called "open" because I invite people to enter my house through it. It's called "open" because that's the adjective that describes it.

To law enforcement agents: I don't really leave wireless webcams in public toilets. They're all wired and I'm sitting in the next cubicle. I'll come out with my hands up now.

Re:Hey,

[Zen Hash]

Seriously, if you don't think there is something wrong with collecting local and transient data and putting them into a big permanent database correlating with other data, by a private corporation that is best known to profit from large scale datamining, you just haven't thought deeply about the issue.

In the articles I read (linked in the story), there is only mention of capturing unnecessary data. Where did you hear anything about putting that data into a database and correlating it with other data? If something as innocuous as simply failing to filter out unnecessary captured data causes so much concern, then anything along the lines of what you described would be huge.

Re:Hey,

[jonadab]

> Oh, and postmen read your postcards too.

They *theoretically* could, but only if they were completely immune to boredom. There's nothing more mind-numbingly dull than reading other people's mail.

Re:Hey,

[Kilrah_il]

As far as I know, in all modern countries you have to pass an Ethics committee before human trials. I think you raise a good point: maybe there should be some sort of privacy-related Helsinki committee. OTOH, the companies probably will be against it, if only because that means passing their products to an outside body for inspection before release - which could be a potential source for product leaks (that is, if they don't forget those products in bars :) ). Notice that many leaks about smartphones come from FCC submissions. I don't think they will want the same situation for software products/services.
I think part of the problem is that companies need to gather more information about users - both to give better service and to get more ad revenue. Sadly enough, many of them don't remember that with great power comes great responsibility, and that's when fuck-ups happen.
Let's hope that at least some of the leading companies will pick up the "Honest is the best policy" line and use it more often.

Re:Hey,

[the_womble]

AFAIK in many countries (such as the UK) it is not necessarily a crime to enter through a unlocked door.

In the case of wi-fi, some people leave theirs deliberately open.

It is also very easy for people to accidentally connect to the wrong network.

Re:Hey,

[the_womble]

Entirely believable. No one looks at code if its working OK.

Re:Hey,

[tcr]

Nice theory.
It was intentional from day one, so they made the world aware of it three years down the line...
Because, like, you can never have enough bad publicity.
 
Remotely plausible?
 
More like - we messed up. This is what we collected. We're getting rid of it.
 
Is it tinfoil season?

Re:Hey,

[flooey]

3. This is the same company that produced this choice quote: "Google CEO Eric Schmidt recently said Internet users shouldn't worry about privacy unless they have something to hide."

This has been kind of overblown. The answer was actually "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.", and he was speaking in the context of court orders. It's just a statement of reality: if Google is holding some of your information and the US Government comes along and wants it, they have to hand it over. So if you're worried about that happening, you probably shouldn't upload it to Google (or anyone) in the first place.

Re:Hey,

[Anonymous Brave Guy]

If you read the actual Google blog post, it's made very clear that getting content was not intentional.

Fortunately, we do not have to trust the corporate PR of a business in making that determination. We can instead consider the facts in evidence.

Did Google deliberately send out vehicles, specially equipped to capture this kind of information, systematically over a period of several years? We know they did. Did they, in fact, collect that information and retain it? We know they did. Did one of the biggest data mining company in the world not know what kind of information they would be collecting? I doubt you're going to convince many courts of that. How exactly is this not obtaining the data with intent?

Re:Hey,

[drinkypoo]

Sure, and your sister was asking for it with that dress she was wearing, right?

It depends on what you might claim she was asking for. She wasn't asking to be raped, but she might have been asking you to stare at her tits. I don't know; she's imaginary.

FWIW, the actions described would probably be criminal and carry jail time if they occurred in the UK (e.g., under the Wireless Telegraphy Act 2006).

They probably did occur there, too.

Re:Hey,

[pmc]

Although some of your points are valid, I think you missed one of the most important issues regarding the entire story: Google were frank about their mess-up.

Not initially - they originally said:

"Networks also send information to other computers that are using the network, called payload data, but Google does not collect or store payload data."

This was wrong and was in response to claims that Google was collecting payload data. The thought this could be in error is ridiculous. First they'd have to accidently collect the data, and then they'd have to accidently not notice even when they went to look for it.

They only (finally) admitted they were collecting payload data when the German government asked for the collected data to audit exactly what was being collected.

Here Google had many options:

1) They could have found about the error and deleted all information the moment the Germans started inquiring - nobody would have known anything. If asked - do like the politician, deny

That would have been fatal - the German government was either on a fishing expedition or already knew what was being collected. For Google to have deliberately deleted data in response to a Government request would have been insane - going to prison, massive fines and "they're evil" type of insanity.

2) They could have issued a short statement claiming that they independently found an error and fixed it, without disclosing too much details.

That would have been untenable - they just happen to find out after they had threatened with an audit.

3) They could have issued a long statement admitting that they started the investigation after the German inquiry, etc

So they did the only vague credible course of action left open to them

We keep asking companies to be honest about their practices and mistakes, but when they do admit wrongdoing, we bash them on /. and then promise not to use their services.

The problem is that few believe they are being honest - acccidently collecting hundreds of gigs of data and not noticing either after you've processed your (our) data or after you've said you've checked and there is defintely no data there.

I'll leave with a final thought - Google claimed that they have never used the data in any product. Given that they claim they didn't even know they had the data until recently how can they possibly make the categorical and emphatic claim that they had never used it in any product. I'd have believed a statement that they didn't believed they had used the data, but were currently auditing to make sure or something. But another straight denial? It makes them look like a six year old caught with their hand in the cookie jar - every answer given to cast themselves in the best possible light with only a vague connection with the truth.

Re:Hey,

[BrokenHalo]

Previous discussions on this topic have often led me to wonder what kind of specific data Google was collecting: All broadcast SSIDs? Open networks? Or were they going as far as to sniff around for "hidden" SSIDs? (Aside from the fact that my WiFi network is on WPA2 PSK, I've stopped hiding my SSID since a couple of members of my extended household have problems reconnecting their defective Windows boxes to it, and I've been a little bothered about security implications of that.)

Hopefully this statement answers that particular question, but of course who's to say Google isn't lying?

Re:Hey,

[BrokenHalo]

disabling SSID broadcast does little: http://technet.microsoft.com/en-us/library/bb726942.aspx

From the article you mention:

Unlike broadcast networks, wireless clients running Windows XP with Service Pack 2 or Windows Server® 2003 with Service Pack 1 that are configured to connect to non-broadcast networks are constantly disclosing the SSID of those networks, even when those networks are not in range.

While I agree with your point, this sounds very much like Microsoft telling us that the only difference between their software and a bucket of shit is the bucket.

Re:Hey,

[BrokenHalo]

Gawd Lewd, let me see if I am too drunk to understand it: Google was caught sniffing someone's open WiFi hotspot using a 4G stolen iPhone while doing a man-in-the-middle attack in a drunk naked girl that had passed out on a lawn while reading a postman's postcard?

I hope so, otherwise you're just too stupid to understand it.

Re:Hey,

[BrokenHalo]

That would have been fatal - the German government was either on a fishing expedition or already knew what was being collected. For Google to have deliberately deleted data in response to a Government request would have been insane - going to prison, massive fines and "they're evil" type of insanity.

How would anybody know? It's not as if packet sniffing is exactly obvious to the whole world. The only way in which Google could be caught with their pants down is if an employee were to spill the beans.

Re:Hey,

[BrokenHalo]

By tying a WiFi MAC to a GPS Coordinate you can use wifi as a sudo-gps solution.

sudo != pseudo.

Re:Hey,

[tomhudson]

Dude calm the frick down. Google is a massive corporation with thousands upon thousands of employees simultaneously working on thousands of projects, using code created over a span of several years by programmers who may have already moved on to another project or left to a different company. It's not inconceivable they would have missed this "feature", especially if it doesn't register as a "bug" that destabilizes their intended operations.

B.P. would like to subscribe to your newsletter.

Re:Hey,

[jipn4]

causes that harm is exactly the same, whether we are discussing invasion of privacy

If you broadcast unencrypted transmission over your neighborhood, it's not an "invasion of privacy" if people listen in. If the default assumption were that all unencrypted transmission are private and the government can punish you for listening in, the consequence would be that nobody can make public broadcasts other than the government.

But presumably that fits your world view just fine: only the government can broadcast, only government media or licensed media outlets can take and publish photographs, etc. All communications need to be registered, de-anonymized, and potentially subject to legal review. Any private company or individual that tries to publish or listen outside the approved government channels will be punished, one way or another.

You've been trained to be a good little totalitarian by your government, and you don't even realize it. Stupidity like yours will kill democracy and liberty.

Re:Hey,

[Gorimek]

Did Google deliberately send out vehicles, specially equipped to capture this kind of information, systematically over a period of several years? We know they did.

How do "we" know this? The Google blog post states the opposite. What other information source do you have about this software?

How exactly is this not obtaining the data with intent?

It's described in the Google blog post. If you refuse to believe it you don't have to, but it does describe a version of events where there was no intent to collect this data.

If there was intent, what would the motive be? It's hard to imagine any more useless data than random intercepted traffic fragments like these. Organizations that actually do record people's internet traffic don't do it this way. They don't write public blog posts apologizing for what they do either.

Re:Hey,

[jipn4]

Google have repeatedly demonstrated some sketchy regard for privacy of others.

Google recorded open, unencrypted WiFi packets. Tons of tools do that. It's not an invasion of privacy.

However officially Google now admit to collecting snippets of payload data which is something they expressly ruled out in the original blog. They say this was a mistake...I have my doubts.

No, it wasn't a mistake, in the sense that the programmer who did it probably didn't think twice about it. Why wouldn't you record open, unencrypted WLAN packets?

I think there is a real difference between data that is public to your neighbors and then someone posting that data on a billboard in the the main street.

Google didn't post the packets that they collected. Even if they had, so what?

Clearly here is an example of data that is not private, in the public domain but is not intended to be distributed to strangers.

If our assumption becomes that data is private unless explicitly marked as public, democracy becomes impossible, because any scoundrel can evade public scrutiny by declaring their behavior to be private.

Privacy is pretty simple: if you don't want people to see what you're doing, don't do it in a public place.

and ensuring my network is buttoned up even tighter the ever.

You're a jerk for implying that Google has been trying to break into anybody's network. In fact, all you need to do as far as Google or anybody else is concerned is to indicate that your network is intended to be private. A minimum level of encryption is sufficient to do that. If you don't encrypt, don't complain if people listen.

Re:Hey,

[K. S. Kyosuke]

Hey, this is *Google*. Have you seen the size limit of a single GMail mailbox recently?

Re:Hey,

[Anonymous Brave Guy]

We know because it is a matter of public record that Google have been sending out StreetView cars, and that those cars were equipped with systems not normally fitted in cars for the purposes of recording data transmitted using wireless networks belonging to other parties.

This was a systematic data collection exercise on an international level over a period of several years by the largest data mining company in the world that is probably a criminal offence under the law in at least a dozen different jurisdictions. I am... bemused, I suppose... that you seem willing to overlook all these facts and let them off, just because one person at Google wrote a few words in a blog post.

Re:Hey,

[pmc]

Apart from it being unethical, suddenly you have a criminal conspiracy where a lot of people know the truth you are trying to hide. Not wise, and they'll be screwed because not many people would want to be involved in a criminal conspiracy to help their employer.

There is also the question in their minds about what the German government knew already. If they don't give back any data or give back fake data that is not consistent with what the government already know - they are screwed.

Finally, even if the government does not know anything apart from what is in the public domain, the challenges of trying to fake enough data to be convincing would be immense, and it would be fairly straightforward for the Government to spot the fraud if there was anything less than a stellar job done. And, once more, they're screwed. And faking the data is another conspiracy - see point one.

So it would be extremely difficult and risky to try and cover it up. And they would have no real benefit - people (like me) who think they are unethical already won't change our opinion, and others, who have a more positive view, will not particularly change theirs. So the downsides of their limited confession are small.

They may or may not be evil, but they ain't stupid.

Re:Hey,

[shiftless]

So you are OK if, in a restaurant, other patrons eavesdrop and record your conversations with your SO/close friend? It is ok to do so in a public restaurant, right?

Would you also be OK for your neighbor to eavesdrop and record the noises coming out from your house, e.g. you arguing with your SO, or whatever noise coming out of the master bedroom at night? Even though they may need a sensitive microphone or a big parabolic dish to do so, from across the street to your house?

After all, not talking in codes or installing noise absorbing wall in your house is an invitation for anyone to passively listen to your conversations, right? What do you expect if you are broadcasting your sound waves on the air in the clear out into public space? Right?

The answer to all of the above questions is YES.

Just because something makes you uncomfortable doesn't mean it should be illegal.

Re:Hey,

[L1feless]

Like in any software Google built this capability in on purpose. It is always better to build more and use less rather than having to redo it all later. Now if it was turned on by mistake or not who cares?!?! It was turned on and captured. This is no different than the 15 year old next door using the WiFi from his bedroom. I agree with many of the other posters. Open WiFi means you're bound to have someone else jump on and use it. RTFM and stop complaining.

Re:Hey,

[espiesp]

Well I tried to use wifi as gps but that command didn't work.

But sudo gps did.

Linux is weird.

Re:Hey,

[Dare nMc]

Google wants to coordinate GPS coordinates with MAC addresses of wireless transmitters. I am guessing they want to allow any wifi device to be able to use wireless, either instead of GPS, or to give a faster convergence time for devices with GPS.
So to get a map of what is broadcasting and where they were using some off the shelf logging software, to get the MAC addresses and strengths. The software was configured to record everything, not just the MAC address and signal strengths that google wanted.

I use Google a lot but...

[Mordok-DestroyerOfWo]

How in the heck do you "accidentally" gather information over a wireless network? If all you want is a collection of AP's that's one thing, but any storage of packet data no matter how temporary cannot be considered an accident. It has to be planned out and executed. An accident is stubbing my toe on the nightstand, this is an invasion of privacy.

Re:I use Google a lot but...

[iserlohn]

Looks like you never used a sniffer (like tcpdump) before...

The accident is leaving off the filter that restricts the traffic you capture...

Try it on a machine you ssh into and you will know what I mean...

Re:I use Google a lot but...

[marcansoft]

AP information is packet data (they're called beacon frames). Looking for beacon frames is a lot more effective at finding APs on the move than using whatever built-in scan feature your card drivers have. They probably had a SNAFU and forgot to filter out data packets in their capturing setup, instead storing everything that hits the antenna (or some engineer didn't realize it would be an issue).

Re:I use Google a lot but...

[Ossifer]

I accidentally gathered the credit cards numbers of all my neighbors.... Oops.

Re:I use Google a lot but...

[Dreadneck]

Google PR Flak: We at Google take you privacy seriously. That's why, after discovering that we had inadvertently collected 600+ GB worth of private citizens' data, we're doing the responsible thing, in this post 9/11 world, and turning the data over to the government for proper disposal.

Yep, nothing to see here. Move along!

Re:I use Google a lot but...

[Mordok-DestroyerOfWo]

You are correct sir. Now that I have a new toy to play with over the weekend I thank you, although my social life does not.

Re:I use Google a lot but...

[Ethanol-fueled]

But why are they collecting that data at all?

The maps and street-view are understandable because they are for the most part static and do not change, but people move in and out of buildings and change things all the time. It's not rocket science to determine that corporations and branches of Starbuck's will have their wireless networks, so why the unecessary invasion of privacy like sniffing MAC addresses? There are other ways to get the location of public access points and the like without having to sniff private residential networks.

Re:I use Google a lot but...

[RoFLKOPTr]

The maps and street-view are understandable because they are for the most part static and do not change, but people move in and out of buildings and change things all the time. It's not rocket science to determine that corporations and branches of Starbuck's will have their wireless networks, so why the unecessary invasion of privacy like sniffing MAC addresses? There are other ways to get the location of public access points and the like without having to sniff private residential networks.

Because it's not for locating public wireless access points. It's about using the location of ANY Wi-Fi network that's broadcasting an SSID (secure or insecure) to assist in geolocation. Google's Street View vans scan for SSIDs and detect signal strength to essentially triangulate the location of every SSID-broadcasting wireless router, and they can use that information with Google Maps Mobile and perhaps other applications to help your device locate you when there's a weak or inexistant GPS signal.

Also, ffs, learn to use HTML tags.

Suuuuure It Was A Mistake ...

[WrongSizeGlass]

They're probably worried about some legal complications ... or even German WiFi police ;-)

New portmanteau : Google + Oops! = Goops!

Re:Suuuuure It Was A Mistake ...

[Sooner Boomer]

"New portmanteau : Google + Oops! = Goops!"

I think in this case it has already been done: (open wi-fi) + Google + Oops! = Oogle!

Re:Suuuuure It Was A Mistake ...

[RockWolf]

New portmanteau : Google + Oops! = Goops!

And a new malamanteau: iOops!

Shenannigans!

[jtownatpunk.net]

You don't "accidentally" collect samples of payload data. That's just absurd.

Re:Shenannigans!

[Anonymous Coward]

Yeah you do. When you say "Hey, let's see what open wi-fi stuff is out there", and tune into those signals, you pick up on some spare traffic...and if you're saving every packet you come across for later processing (like 'what open wi-fi router was this'), then yeah, it's going to get saved like the rest.

Then they looked at the data they'd saved, said "Oh hey we didn't mean to get that stuff". Kind of like if you're logging all data that someone sends when they're connected to your open Telnet port, and you realize later that it saves their username/password along with the rest--it wasn't a conscious decision, you might not have thought about it at all, you might never plan to even look at the logs except in some specific cases, and while a workaround might take some time...you kind of drop a brick when your legal team realizes you have it.

Re:Shenannigans!

[wondershit]

hey /. I need your help
I accidentally 93MB of Wi-Fi data
what should I do...is this dangerous ?

Re:Shenannigans!

[ukyoCE]

Wow, "sniffing unencrypted wireless traffic", that's a bit of a misnomer don't you think?

Like how I eavesdropped on the loudspeaker at the ball game?

Google was *listening* to unencrypted publicly broadcasted traffic. That's how they find public access points.

Sounds like my daughter when she was 6

[Locke2005]

Me: "Why are there drawings all over the wall?!?"
Her: "It was an accident! I didn't mean to do it!"

Re:Sounds like my daughter when she was 6

[Anne_Nonymous]

You forgot the other appropriate responses:

"What drawings?"
"I didn't do it."
"Pooh Bear did it."
"Davy did it."
"Davy made me do it."
"Davy told me to do it."

and the ever popular,

"I love you, Daddy."

Skyhook competitor

[ad454]

Now that Google has all that StreetView WiFi data, maybe they can put together a free WiFi geo-location service alternative to Skyhook:

http://en.wikipedia.org/wiki/Skyhook_Wireless

With regards to privacy, Skyhook has already let the cat out of the bag.

Re:Skyhook competitor

[ad454]

When I said free, I mean purely advertisement supported, since nothing Google does is really free.

Re:Skyhook competitor

[Fencepost]

They might be doing so. Google Maps on my Blackberry 8320 (no GPS) shows my location to within a few hundred meters in a few places, and I can think of multiple ways they could be doing so all of which involve WiFi.

Re:Skyhook competitor

[Matt_R]

Now that Google has all that StreetView WiFi data, maybe they can put together a free WiFi geo-location service

Like this?

Re:Skyhook competitor

[Drew M.]

Google has that already. Any Android device, Chrome browser or Google Gears installation can already locate itself using that exact method. Try it.

Excuse

[Dan East]

Since they made up an excuse before they were caught they're in the clear on this one.

Re:Excuse

[Anonymous Brave Guy]

Since they made up an excuse before they were caught they're in the clear on this one.

No, they didn't, so no, they aren't. This behaviour was revealed when German authorities asked to audit the data the company's Street View cars gathered.

Re:Meanwhile Skyhook makes no statement

[dangitman]

Huh? What evidence do you have that Skyhook was inspecting packets that travel over those access points?

Riiiiiiiight.

[LurkerXXX]

So if you were going to set up a wireless rig to map open wireless locations, exactly how would you 'slip' to start also mapping what traffic was passing through them? That takes a good bit more work than simply noting the SSID. Accident my ass.

Re:Riiiiiiiight.

[chill]

Actually, it takes LESS code. They probably wrote a sloppy bit of code to grab a few seconds of packets, then filtered out SSIDs later. Probably just a Perl script hooking into libpcap and dumping to a file.

Re:Meanwhile Skyhook makes no statement

[kindbud]

What evidence do you have that Google was, other than Google's own statement?

If Google made no statement, would you assume they were not capturing payload, like you assume Skyhook isn't?

Double standard, dude.

Google is great and all...

[Spykk]

As much as I like Google I hope they get the book thrown at them over this. To claim that they have accidently been collecting this data for three years is just silly. If you can make money breaking the rules and there are no consequences when you get caught then why would anyone follow the rules? Corporations are rarely influenced by things like morals or ethics unless there are financial penalties making it the cheapest option.

Re:Google is great and all...

[Jimbookis]

Corporations? We have to stop pretending corporations are 5000 pound three year olds who needs constant berating and correction to be kept in line. There are intelligent PEOPLE in corporations who are making these decisions and they need their arse handed to them on a plate.

Re:Google is great and all...

[Dirtside]

As far as I can tell, Google posted this message without being forced to by any government. Most companies would keep this kind of thing quiet, or lie about it, especially if privacy advocates got wind of it. Google, within a few days of finding out about the issue, posts an APOLOGY for doing something that MIGHT have possibly damaged a few people, IF the information they collected had been leaked.

Unless we have reason to believe otherwise, Google screwed up, and as soon as they were aware of the mistake, took steps to rectify it and then went public about the mistake. If we get evidence that Google is lying about this, that's another story, but has there been any such evidence yet? I'm all for raking corporations over the coals when they make mistakes and don't own up, but how often do you see a giant corporation blurting out "mea culpa" like this?

Also:

As much as I like Google I hope they get the book thrown at them over this. To claim that they have accidently been collecting this data for three years is just silly.

It's not remotely silly. A week ago I discovered a DB table at my (multinational media conglomerate) company that had been silently logging data for -- wait for it -- three years. It wasn't any personal info, or data we needed, but everyone had forgotten about it. The idea of Google making a similar mistake is not "silly" at all.

Re:Google is great and all...

[FriendlyPrimate]

I respectfully disagree. If they're telling the truth (and I have no reason to believe that they're not), then they didn't even realize they were collecting this information. They did not use it for monetary gain.

If anything, this gives me more respect for Google, since they did not have to reveal this information (they could have indefinitely stonewalled...there's no external evidence that they kept this data). They're willing to admit when they do something wrong. That scores points in my book. Kudos to Google.

Re:Google is great and all...

[Anonymous Coward]

So let me get this straight:

- A company accidentally collects data that careless users broadcast to anyone who is listening.
- The data is largely worthless anyway due to the circumstances. (car was in range for almost no time, users would have had to be transmitting at exactly the right time)
- The company doesn't realize they actually have this data, and doesn't do anything with it.
- Once they actually find out they have this data, instead of trying to hide it or make excuses, they voluntarily come forth and detail exactly what happened and exactly how they're going to get rid of the data, including allowing third-parties to inspect their code.

... and you think they should be PUNISHED for this? If anything, all companies should act this way.

Re:Google is great and all...

[tftp]

- A company accidentally collects data that careless users broadcast to anyone who is listening.

Two people have a quiet, private conversation in an empty street. They have a reasonable expectation of privacy. A car with a sensitive microphone drives by and records several seconds of the conversation, without participants' knowledge.

- The data is largely worthless anyway due to the circumstances.

Google wouldn't deploy a system for collecting worthless data on thousands of StreetView cars over three years. It's not like a lowly code monkey made a build with a few extra #defines, threw it over the wall and forgot about it. The car has to have WiFi, the operators have to be trained to use the system, and the collected data has to be taken out of the car and stored somewhere on company's servers. This can't happen accidentally.

- The company doesn't realize they actually have this data, and doesn't do anything with it.

That assumes that thousands of Google coders, workers and managers are idiots. Far more likely is that Google, being in data mining business, were perfectly aware of every aspect of this collection. It costs money to run StreetView cars, so they packed the cars with everything they could think of, and collected everything that they could.

- Once they actually find out they have this data, instead of trying to hide it or make excuses, they voluntarily come forth

The "voluntarily" part was forced - see the TFA:

Alan Eustace, senior vice president of engineering and research for Google, wrote in a blog post that the company uncovered the mistake while responding to a German data-protection agency's request for it to audit the Wi-Fi data

Google was silent about it for three years, but once they were asked a direct question they decided not to lie. When a lawyer asks a question he already knows the answer, so lying in these circumstances would be much more dangerous.

Re:Google is great and all...

[khchung]

Wish I had mod points to mod you up.

I read TFA, but it is very light on details. Did Google said they are going to DELETE those data now? I couldn't quite find that in TFA, it only quoted Google will "learn all the lessons we can from our mistake".

Did they consider their "mistake" being collecting the data in the first place, or does "mistake" mean the PR nightmare after they were found out doing that? Learning their lesson could either mean stop collecting so much data, or it could mean not letting other people find out how much they are collecting the next time.

Re:Google is great and all...

[tog000]

When you have an open, non encrypted "conversation" over wifi, you are automatically disqualifying it from being private: youre not whispering anymore, you are talking out loud and nobody needs a "sensitive microphone" to hear what youre saying...

Re:Google is great and all...

[Anonymous Coward]

As far as I can tell, Google posted this message without being forced to by any government.

That's incorrect.

"The issue came to light after German authorities asked to audit the data the company's Street View cars gathered as they took photos viewed on Google maps."

http://news.bbc.co.uk/1/hi/technology/8684110.stm

Re:Google is great and all...

[Zen Hash]

That assumes that thousands of Google coders, workers and managers are idiots. Far more likely is that Google, being in data mining business, were perfectly aware of every aspect of this collection. It costs money to run StreetView cars, so they packed the cars with everything they could think of, and collected everything that they could.

You're assuming that "thousands of Google coders, workers and managers" are auditing the parameters passed to tcpdump in some script or at least looking over the raw capture files rather than the output data.

Re:Google is great and all...

[bloodhawk]

google are a technology company, a company whose technology "Accidently" collected more private data than it should have. And this makes you trust them more? So technical incompetence is fine with you as long as they own up to it afterwards? this is a company that actively collects private data and you trust them more when they show they don't have a clue about how there technology works?

Re:Google is great and all...

[Dirtside]

These "German authorities" asked to audit Google's data, but nothing in there says that they ordered Google to publicize the findings or issue an apology. We'd need to know more about what happened there. Also, we don't know whether they ordered Google to let them review the data, or they simply requested it and Google said "yes."

Re:Google is great and all...

[tftp]

You're assuming that "thousands of Google coders, workers and managers" are auditing the parameters passed to tcpdump in some script or at least looking over the raw capture files rather than the output data.

If people in charge haven't had time even once in three years to look at what they collected, they are idiots by anyone's definition. Intercepting of other people's communications is a crime in many countries. It's perfectly legal to receive AP's broadcasts that advertise it, but once you start capturing packets that are sent to (or from) other computers, you are receiving "legally protected" (but not physically protected) data that is not for you. Lawyers in different jurisdictions may have different laws on this subject, but intercepting other people's data is amoral in most human societies.

Re:Google is great and all...

[Zen Hash]

You're assuming that "thousands of Google coders, workers and managers" are auditing the parameters passed to tcpdump in some script or at least looking over the raw capture files rather than the output data.

If people in charge haven't had time even once in three years to look at what they collected, they are idiots by anyone's definition. Intercepting of other people's communications is a crime in many countries. It's perfectly legal to receive AP's broadcasts that advertise it, but once you start capturing packets that are sent to (or from) other computers, you are receiving "legally protected" (but not physically protected) data that is not for you. Lawyers in different jurisdictions may have different laws on this subject, but intercepting other people's data is amoral in most human societies.

What they were collecting were locations of access points.To collect that data, they had equipment in the vans capturing data broadcast by those access points and processing it to determine their location. When a vehicle is moving around, it is not within range of most networks for very long. You can only capture a limited number of frames in that time period. Then you use software to analyze the signal strength data from those frames, along with the gps log, to determine the locations of the access points. This only looks at lower layer segments of those frames, and the higher layer segments (including the payload) don't affect it.

Google failed to go back and delete the raw capture files. Maybe they wanted to keep the raw data in case there are future improvements in the analysis software. If that's the case, they failed to reprocess the captures and edit those frames to remove any potential user payload data. I'm not aware of any functionality for doing this on-the-fly with any of the open-source tools for capturing traffic. Ignoring all information from all non-beacon frames would have far less accuracy, especially in areas where wifi is heavily used. There isn't anything to indicate that they had any interest in any user payload data, or that any of it was collected anywhere outside of the raw capture files.

The whole purpose of using analysis software is so that you don't have to look over large amounts of meaningless raw unfiltered data... I'm willing to bet there are some sources of raw data that you have and fail to thoroughly review by hand. For someone who has a job to do, wasting that much time isn't usually an option. Even for someone who doesn't have a job, that still could require more time than they have depending on the amount of data.

Anything capturing data is going to inevitably collect some data that is not intended for it. For example, if you've ever typed around any audio recording device. That captured audio can be analyzed to determine what you typed, even if it was not intended for the person capturing the audio. Or if you've ever been to a tourist attraction you've probably been at least captured in the background of other people's home movies, whether or not you indented to be.

Re:Google is great and all...

[tftp]

edit those frames to remove any potential user payload data. I'm not aware of any functionality for doing this on-the-fly with any of the open-source tools for capturing traffic.

It's just too bad that those open-source tools are closed source, and in any case Google has no programmers on payroll to do the necessary changes :-) Otherwise they'd learn that it is a one line change: a memmove() call. The position and size of the payload is well known within the packet. Or if you want to keep the format of the output, use memset() instead and zero the payload.

These changes would not only ensure that they are in the clear in terms of computer trespass, memmove() also would reduce the storage requirements. It is possible that nobody at Google was thinking ahead. Google is a company of young people, and those may not be sufficiently worried about legal stuff. And there was no oversight at all, even by Google's legal department. I'd think that when you send thousands of cars into foreign countries to record stuff you'd involve a lawyer or two... this looks like incompetence that flows from the very top.

Re:Google is great and all...

[Zen Hash]

edit those frames to remove any potential user payload data. I'm not aware of any functionality for doing this on-the-fly with any of the open-source tools for capturing traffic.

It's just too bad that those open-source tools are closed source, and in any case Google has no programmers on payroll to do the necessary changes :-) Otherwise they'd learn that it is a one line change: a memmove() call. The position and size of the payload is well known within the packet. Or if you want to keep the format of the output, use memset() instead and zero the payload.

These changes would not only ensure that they are in the clear in terms of computer trespass, memmove() also would reduce the storage requirements. It is possible that nobody at Google was thinking ahead. Google is a company of young people, and those may not be sufficiently worried about legal stuff. And there was no oversight at all, even by Google's legal department. I'd think that when you send thousands of cars into foreign countries to record stuff you'd involve a lawyer or two... this looks like incompetence that flows from the very top.

You're right about the changes being trivial, but apparently whoever set this up didn't bother to make those changes. Maybe they weren't concerned with saving disk space. This really isn't anything new.

For anyone sending private or sensitive information unencrypted over open wifi networks, there are far greater threats than what little traffic Google may have captured in the short amount of time that one of their vehicles may have been in range of the network.

Re:Google is great and all...

[tftp]

there are far greater threats than what little traffic Google may have captured

North Korea has a nuclear bomb, but that doesn't mean that the police in Nowhere, KS shouldn't be arresting a pickpocket - even if the thief only stole one penny.

In Google's case we are dealing with a massive data collection program. You are right that the van is in range of any given AP only for 10-20 seconds. However in heavily populated cities the van is *always* in range of some APs; this is equivalent to parking the van in front of someone's home, statistically speaking. Sure, if the van moves they will collect random blocks of data - but since they don't care who to spy upon it is just as good as spying upon some specific person.

On top of that, there are cases when *any* exposure to the traffic is an invasion of privacy. For example, people may run torrents or newsgroup agents 24/7. Even if you observe for one second you will see lots of traffic, and it is not encrypted.

With regard to the fact that anyone can do that, not just Google: it is true, if the connection is not encrypted then everyone can access the payload. However a lot of privacy depends on other people not being expected to do certain things. For example, hardly anyone uses dense black cloth as window curtains at night; a determined Peeping Tom with binoculars can see through many curtains. But there are very few determined Peeping Toms, and when they are discovered (as is the case with Google) they are accused of crime and prosecuted. This is doubly so in countries where capture of someone else's computer traffic is a crime. I'm not a lawyer, but the US Code specifically defines it as a crime to "(a) intentionally intercept[s], endeavor[s] to intercept, or procure[s] any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication;"

What Google did is similar to driving the vans at night and using a high zoom camera to take pictures of all lighted windows in the city. If you take enough pictures some of them will contain "interesting" material. So in my opinion if Google captured the 802.11 payload they committed a crime in the USA. The claim that the data wasn't used [yet] is not very important here; if a thief steals some c/c numbers it's a crime on its own; if he uses those numbers then he gets extra charges for that.

The company said it would dispose of the data ..

[AHuxley]

Not before giving the US gov a copy directly or via a 3rd private party?
The fun of "in any Google products" part is once data is collected it can be 'packaged' for 'testing' 'internally' and end up as some external snapshot prototype bundle.
The maps with WiFi data could have been floating around different 'partners' from the point of creation until the "dispose" date.
Just because Google pulls the plug only after been exposed does not really give any comfort.
How does real world physical Wi Fi mapping become a simple mistake?
Someone installed the software and hardware, tested it and kept it running ...

Everyone Apologizes...

[retech]

McDonald's tells everyone: "... we're sorry we made you obese..."
Steve Jobs said: "We didn't mean to only give the artist $.01 and keep $.70 for us on iTunes."
Haliburton mentioned: "Oil spills? We had no idea this could happen."

To trust a company with anything is just stupid. Lock up your doors (or WAPs) people and expect the worst from anyone, you won't be disappointed.

Re:Everyone Apologizes...

[Naturalis Philosopho]

Look up "hyperbole".

What are the legal ramifications for the people?

[Tanman]

If the government subpoenas Google to see the nature of the data they 'accidentally' collected, can they hunt through the data for evidence of illegal activities by the individual users and then go after them? This seems like it would be a great way for The Man to have access to private data by circumventing unreasonable search protections. After all, they just happened to notice this data while checking to see what data Google had been stea, er, storing.

It's like an addiction with a twist...

[MindPrison]

...on one hand we all love to use Google, let's face it - it's the no#1 search engine, finds more data for you than you could ever dream of coming up with on your own or any other engine, shows you the way on your navigator - heck...even shows you where to get hot coffee on a rainy day, free mail service, supports open-source initiatives all over, man - that's like free drugs, you WILL get addicted, and there's really no way out.

Google and the government have ONE thing in common though, power. And knowledge is TRUE power. Imagine if you knew everyones dreams, thoughts, loves, hates, inventions. Google knows pretty much everything there is to know about me, and yes - I have volunteered to this, I'm addicted to Google, I love what Google provides me with, and I've seen nothing truly sinister from them the last 10 years, something about the truth shall set you free? Maybe there's something to that old saying.

But the government knows pretty much what they want to know too, why destroy a good thing? I don't think the recording of WiFi spots was a "Mistake", no one in their right mind can make that big of an engineering mistake, it uses extra data, no optimisation in that, but you got to tell them something, so it was an accident.

Do I believe that Google is Evil? no - I don't, but with any great power - especially knowledge - you have to use it with care, and be careful to whom you hand it to. Admit it - you want knowledge, why should they be any different, the difference is - you hand it to them - voluntarily, and thats not necessarily a bad thing.

Remember that movie "What Women Want"?, great flick btw. Mel Gibson all of a sudden by accident, gets the gift of being able to read every womans mind, he can hear them speak. This momentarily drives the man crazy, but at the psychologists bench, he discovers that this knowledge is truly a gift - if you knew what a woman want all the time - you could RULE the world.

There's some truth in that, if you know your audience, you can please your audience like no one else, and you can have it all, future inventions will be based on millions of minds - worldwide - tell me - who would NOT want that?

Re:It's like an addiction with a twist...

[BlakJak-ZL1VMF]

Aparrently 'do no evil' doesn't translate to 'be open and honest about exactly what it is we're doing when we drive around your neighbourhood in our camera-van'.

They could've headed this all off by disclosing it openly in the first place, instead of claiming 'accidental' data collection.

Re:It's like an addiction with a twist...

[MindPrison]

They could've headed this all off by disclosing it openly in the first place, instead of claiming 'accidental' data collection.

Yes they COULD, but imagine if you were the government, and you were told to finally disclose to the world that we've been discussing and negotiating with Aliens for over 50 years now, and we're about to tell YOU that - the world would go MAD in an INSTANT, so - what you do, is to reveal as little as possible, in small bite-sized chunks, and of course - everything available to anyone who wants to know...no secrets here...but they just would not plaster BIG BANNERS all over the place saying - hey look, we've got Aliens!

Google is already struggling with half the planet who's mostly technically illiterate, try telling the people who doesn't even have a computer what they're doing, and you'll have worst-case scenarios raining all over the place.

Re:It's like an addiction with a twist...

[Dirtside]

no one in their right mind can make that big of an engineering mistake

Like the kind that cause a bridge to collapse, or a space shuttle to blow up shortly after launch?

Re:It's like an addiction with a twist...

[BlakJak-ZL1VMF]

Maybe, and fair point, b ut it could've been mentioned as an aside and would've either been overlooked, or served as a warning to folks to hide their SSID's. If you provide fair warning to folks who then ignore the warning, they have nothing to rant about.

The fact that this has transpired 'on the sly' is half the problem .

Impossible Accident

[alfarovive]

The way I see it.... if you designed a car that can scan local wifi spots and linked it with a method to store that information and you then built that machine and set it loose.... kinda like saying "I followed the recipe, put the dough in the oven, but I never thought I'd make a cake."

Re:Meanwhile Skyhook makes no statement

[Jugalator]

What evidence do you have that Google was, other than Google's own statement?

Why is more evidence necessary?

If Google made no statement

but they did

Kismet Does This Automatically

[docstrange]

I wonder if they were using "off the shelf" open source tools to collect this information.

By default Kismet will log the pcap file, gps log, alerts, and network log in XML and plaintext.
http://www.kismetwireless.net/documentation.shtml

It is entirely possible that they were using off the shelf open source tools and this log type was simply not turned off in the configuration file.

Re:Kismet Does This Automatically

[AHuxley]

Thats fine for a war driver and a laptop.
Google was mapping cities and the data flow would have been non trivial.
Someone signed for this.

Re:Kismet Does This Automatically

[detritus.]

If this were the case, the data captured would likely be of little to no use by anybody. Kismet constantly hops channels and whatever data is being sent in the clear on a specific channel for a fraction of a second will be dumped to a pcap file. At most you may expose the mac addresses of machines connected to the AP's network and little fragments of communication, but only for small fractions of a second.

How could half of everyone be so dumb?

[Anonymous Coward]

Half the comments on this thread are violently stating: "There is NO WAY that anyone could accidentally collect that kind of data, it must have been on purpose.

The other half of the comments are arguing that there's no way this could have been malicious, because the technology really does make it easy to log the wrong stuff.

Sounds like half the commenters here need to shut their pie-holes. Slashdot is more full of people who are wrong and sure they are right, than a flat-earther convention.

Re:How could half of everyone be so dumb?

[AHuxley]

Half of the commenters know of COINTELPRO, the NSA, the Chruch report, Room 641A ect.
The other half enjoy animated Powell Point press presentations.

Dishonest practice

[Bigmilt8]

An honest mistake. Wait until they post some companies inter-company information on the public web. Oh wait, they did do that.

The difference with Google's response

[KrugalSausage]

The difference with Google's response is that they find these problems after internal investigations. Most companies require govt. intervention these days. Glad they caught the mistake!

Re:The difference with Google's response

[AHuxley]

After a German newspaper Der Spiegel caught the data collection.
The only internal investigations Google is doing is to find out how they where exposed.
http://www.smh.com.au/technology/technology-news/please-explain-why-google-wants-your-wifi-data-20100513-uyyh.html
As for "require govt. intervention" they did not seem to know in Germany, UK, Australia ect.
"Given it was unrelated to Street View, that is accessible to any WiFi-enabled device and that other companies already collect it, we did not think it was necessary. However it's clear with hindsight greater transparency would have been better."

Re:The difference with Google's response

[LurkerXXX]

"Internal investigations" brought on in preparation for a government audit that was happening to them in Europe. This isn't something Google just decided to do all by themselves. They knew they had to find it themselves quick or the government would and would slam them hard for it. So it was really govt. intervention. Google is just as crappy as other companies. They aren't saints.

Re:The difference with Google's response

[Ant P.]

The difference with Google's response is that they had the honesty to respond. They could've just quietly brushed this under the mat.

Re:What are the legal ramifications for the people

[AHuxley]

The same as for the NSA linked telcos - 0.
Google is a top US telco like entity connected around the world with wide pipes back to US gov friendly tap points.
Google can only be harmed by internal leaks eg a Room 641A story.
Google is just too networked to fail and still has that welcomed feel in most pasts of the digital world.

Re:The company said it would dispose of the data .

[denmarkw00t]

Well, if they packaged it and whatnot, as in removed personally identifiable information and formed bare demographics, go ahead and sell it. I'm as upset as anyone else when it comes to companies selling personal info, but there needs to be some leeway - if a company says (and can prove) that the information they're gathering is to sell but only when personal information is wiped, I don't care. Form a base demographic, it is how business is run, but you can do it while discarding personally identifiable information.

Re:What are the legal ramifications for the people

[im_thatoneguy]

Not legally.

Re:Meanwhile Skyhook makes no statement

[dangitman]

"Dude," your post makes no sense whatsoever.

How would they notice?

[Gorimek]

Those are valid questions if anyone knows the data is there.

If, as Google claims, they just reused some code they had lying around, and it stored more data than they were aware of or wanted to use, I can see how no one would have noticed. Their system worked, and an extra 600GB of disk space will hardly raise any alarms at a Google data center.

Re:How would they notice?

[eln]

The idea that a large company like that would embark on a huge project like StreetView without thoroughly auditing the code they planned on using boggles the mind. Either they didn't carefully audit the code before deploying it in their massive global project or they did and knowingly collected this data. I'm not sure which of those options makes Google look worse.

Re:How would they notice?

[NekSnappa]

If you're collecting data you probably plan to use it. Now if you go to the data set to put it to use you'll see that there is more stuff there than you expected. So how can you say "I didn't know that I had all these snippets of traffic on the network I was sniffing."?

Re:How would they notice?

[Shompol]

Have you ever worked at a huge software company? Here's a raw picture for you:

There are 1000's of programmers struggling to maintain 1000,000's of lines of code, not written by them but by generations of programmers who came before. Bugs and malfunctions popping here and there, client complaints have to be fixed as priority #0. 90% of bugs and malformed functionality sips through, unnoticed sometimes for years, until a client or QA stumbles upon it.

As such "thoroughly auditing the code" will catch extra 10% of _stuff_ at a great expense. Achieving 99% blunder-free system belongs to undergrad projects and a parallel universe from your dreams.

Re:How would they notice?

[maxwell demon]

Achieving 99% blunder-free system belongs to undergrad projects and a parallel universe from your dreams.

No, you got it backwards. In the real universe, all software is perfect. You are just currently in a nightmare. But don't worry, in a few minutes your perfect alarm clock will wake you up (in a perfect way which doesn't in any way disturb you, but you'll get awake in a happy state), and you can tell your nightmare to the digital psychiatrist (which of course is better than a human psychiatrist could ever be).

Re:How would they notice?

[ZorbaTHut]

Here's how this sort of thing works.

First, you write some code, and then you test it indoors. Then you debug it until you run out of bugs.

Then you bring it outdoors, with the hardware suite in your passenger seat, and drive it around for a bit. Then you debug that until you run out of bugs.

Then you get someone in a remote location to do the same thing. Then you debug that until you run out of bugs.

Then you hire a few cars to drive around for a day or two. Then you debug that until you run out of bugs.

Then you cover a neighborhood, or a medium-sized city. By this point, it works. Is it missing stuff? Maybe. Is it picking up more than it should be? Maybe. But you think it works, and, honestly, that's all you can ever be sure of.

And then you keep scaling up. You fix bugs as they arise, you carefully test dubious areas, but overall, if it's getting the data you expect, you don't worry about it too much.

I imagine what they did was "record everything to a file", and then, later, "scan that file for beacons". In reality, they should have been doing "record beacons to a file", and then "read that file", but I can certainly see how the mistake was made.

Re:How would they notice?

[AnEducatedNegro]

I imagine what they did was "record everything to a file", and then, later, "scan that file for beacons". In reality, they should have been doing "record beacons to a file", and then "read that file", but I can certainly see how the mistake was made.

Sounds like a rookie mistake.

Open, not open source.

[webdog314]

IANAL, but having an "open" network does not mean that everyone is legally free to use it. It just means that it isn't protected. Unless the owner of that network specifically says that it is freely "open to the public for use", I would assume that such packet sniffing would fall under standard wiretapping laws.

Re:Wow, just wow

[tehIvyn]

I know its par for the course for Slashdot people to joyfully suck Googles dick whenever Apples dick isnt up for grabs, but for fucks sake, wipe the gizz of your chins and get real - Google got CAUGHT yet again collecting data on the lives of private citizens - I pity you naive sycophantic faggots that still believe they aren't evil.

You must be new here.

Someone's got to say it

[gyrogeerloose]

Google is the new Apple which was the new Microsoft.

In other words, you can't really trust any big corporation. Enjoy the good stuff they may produce but keep one hand on your wallet (or your personal data).

And we promise from the bottom of our hearts...

[hyades1]

That we'll never, ever, EVER do it again until the next time.

Have these data been used?

[Mad Hamster]

Saying "we never used that data in any Google products" (Alan Eustace of Google quoted in TFA) evades the rather more interesting question of whether the data has been used at all, and if so, how, and by whom.

I've done the same thing.

[saiha]

When I was in highschool I would write down anyone password I saw someone type into the computer. It was completely by accident though, I didn't mean to carry my notepad and pen with me where ever I went.

Shaggy defense

[roman_mir]

I prefer the Shaggy defense myself:

What happened to the walls there? - It wasn't me.
What about your crayons here? - It wasn't me.
And why that ink is on your hands then? - It wasn't me.
What kind of a weak ass defense this? - It wasn't me.

according to this google should be arrested

[doom_tech2099]

"How can it be a crime? It's not a secure communication."
But Mr. Burkoff said that it's one thing to listen to police information and even to share it. It's another, though, to provide it to someone for potentially criminal purposes.

"Men arrested for G-20 Twittering say it's free speech"http://www.post-gazette.com/pg/09278/1003126-53.stm
Corporations are always above the law.

NO matter how you turn this it is bad

[bloodhawk]

Google either knowingly collected the data and are evil and not to be trusted

Google accidently collected this private data and are incompetent and should NEVER be trusted with any sort of data EVER

I can't see any other way to look at this that doesn't make google bad.

not like they don't get this stuff other ways...

[token_username]

Google should never have done this, but to think the data they got was much more than they already can obtain through a user's use of Google search and other services is a bit naive. I guess I'm a bit more concerned about how they store customer data rather than this situation where they admitted they were wrong.

I call BS

[cheros]

That someone leaves some code in the Streetview car software, OK, maybe. That just means their software development process needs work. However, that code doesn't work in isolation - the data it collects has to be gathered and processed somewhere too, and Google is asking me to believe that back end process just "accidentally" happened to be there too?

Pull the other one, I call BS.

It's more likely they were caught with their pants down by the Germans asking for an audit and are now scrambling for an excuse. Notice how quickly we got the "sorry" and "we let our users down", that's an indication that they know full well they were caught red-handed again, and know it.

Google, don't worry about losing my trust.

You never had it to start with.

Index the world

[VanderJagt]

Ooh Google, you should. That would be cool. q-:

Accident...

[J'raxis]

"I swear that going house to house jiggling doorknobs and poking at windows was an accident. Yeah, all those tools I had with me to pick locks and pry things open... yeah, had 'em on me by accident too."

BFD

[jipn4]

They captured a few packets from open WLANs as they were driving around. Lots of tools do that. European privacy regulators are using that to beat Google over the head with for political reason, nothing more.

you are so wrong

[jipn4]

It's a long-standing principle that if you broadcast information publicly, other people can legitimately listen in. That's why Google Streetview (or anybody else) can legally take pictures of you in public, and why amateur radio and CB transmissions are not private. Trying to place restrictions on the recording of unencrypted wireless transmissions is wrong.

FWIW, the actions described would probably be criminal and carry jail time if they occurred in the UK (e.g., under the Wireless Telegraphy Act 2006).

Then the UK law is wrong as well (hardly a surprise given their history).

most of the world is enlightened enough

Most of the world consists of undemocratic police states.

Re: sorry! we spied inadvertently

[kubitus]

be happy - first time the NSA apologizes!

if not direct so indirect.

a small encouragement to use your own brain:

WLAN data and position can be used to home in on targets when GPS failes!

whew!

[boniggy]

well im SO glad that it was just all a big mistake... i mean its so easy to collect wifi data by mistake.... its not like you need a wifi scanner to find the open wifi's in the first place. An im sure that the largest internet conglomerate of information wouldn't want that useless, mapped information of every wifi network throughout US,AU,UK etc.... PAH-lease... its main purpose is a P-H-O-T-O car... and now they say they mistakenly gathered wifi data too? gimme a break.... and im sure they have the entire world mapped out as well.... its not like the first time they did it (Germany & Aust) they just happened to get caught... i like google and use it like everyone else does... but their thirst for data/information is starting to get outta hand, it seems.