Slashdot Mirror
Google's Streetview Privacy Snafu Prompts Lawsuit
shmG writes "Google's secret data collection has prompted a class-action lawsuit that could force the company to pay up to $10,000 for each time it recorded data from unprotected hotspots, court documents show. The incident, which the company claims to have been unintentional, has prompted the ire of governments and privacy groups around the world. Google collected information that could be used to identify users, including 'the user's unique or chosen Wi-Fi network name, the unique number given to the user's hardware ... [and] data consisting of all or part of any documents, e-mails, video, audio, and VoIP information being sent over the network by the user,' the suit stated."
If they lose the class-action suit they'll just have to pay the lawyers and give out discount coupons for Google search.
Google collected information that could be used to identify users, including "the user's unique or chosen Wi-Fi network name , the unique number given to the user's hardware...[and] data consisting of all or part of any documents, e-mails, video, audio, and VoIP information being sent over the network by the user," the suit stated.
That should read:
Google collected information that could be used to identify users, including "the user's unique or chosen Wi-Fi network name , the unique number given to the user's hardware...[and] data consisting of all or part of any documents, e-mails, video, audio, and VoIP information being broadcasted publicly by the user," the suit stated.
'Political power grows out of the barrel of a gun.' - Mao Tse-tung
I mean, all those people were using WPA, WPA-2, or at the very least WEP.
What I am really curious about is if this comment will be modded funny, or some other thing....
*** Suerte a todos y Feliz dia!
Vicki Van Valin ... said that their homes' wireless networks were infact not password protected... In connection with her work and home life, Van Valin transmits and receives a substantial amount of data from and to her computer over her wireless network. A significant amount of the wireless data is also subject to her employer's non-disclosure and security regulations
WTF. Her security was certainly broken, but not by Google - she broke it herself. She should be fired for not using encryption. I know it's wrong to wish ill upon somebody, but in this case, the security of her employer's data is more important than her job. If she does this kind of stupid stuff, she should get a job not involved with confidential data.
The pair also claimed to have sent credit card and banking data over their networks.
If you send your credit card info and bank info over unencrypted HTTP, you have bigger problems to worry about than Google.
You are one programmer. Google is dealing with hundreds of programmers and -huge- programs. Some bit of old code they thought they deleted or disabled really wasn't, it got a bit of data, Google realized it, and is going to delete it. I don't see how this is sooooo terrible. This is less data per user than your neighbor with Wireshark running for 15 minutes would get, if you care about your privacy use encryption. Simple as that.
Taxation is legalized theft, no more, no less.
Some are complaining that this was some kind of breach of privacy, maybe breaking several laws (very debateable). Others are asking why this is even an issue since unencrypted wifi is freely viewable. So what on any of that!
Why was the Google StreetView system collecting this data to begin with?
Really, to collect this data, the street-team had to be running wifi in the vehical, purposely vacuuming all the data it could snif out of the air, and dumping it to a rather large drive. Why did this setup exist? Why was this system actively aquiring all this data? Was this being done by some of the streat-teams, or all?
My thoughts are that this really was a simple mistake, likely from a misconfiguration. The likely intent was to gather open access points, like war-driving writ large, but a misconfiguration led to aquiring more than just the AP location/name/basic config- it grabbed whatever was being transmitted at that time. Of course, an oops like that, that was then allowed to continue (possibly), could be a firing-offense as it should have been better setup.
I hope this comment is well received... I could have moderated instead!
Persecutors will be violated!
As another poster pointed out "Germany's privacy laws generally restrict photographs of people and property without a person's consent, except in very public situations, such as a sporting event." therefore your example is TYPICAL of what is *NOT* allowed to to be saved without your consent. It is not the fact that you can be looked at (or the data packet inadvertently caught) it is the systematic saving of the same data (or phtography) which is udner fire.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
This'll send Google a clear message -- honesty doesn't pay off. If you fuck up and overstep your bounds, for crissakes do NOT let anyone know you did it.
So, uh... What you're saying is that, in a contingency case, if the judgment is for a LOT per plaintiff, the lawyer doesn't get most of it, but if it's for a LITTLE per plaintiff, then he does. Right?
Let's try 10,000 plaintiffs, $10m judgment, 25% fee. Lawyer gets $2.5m, each plaintiff gets $750. Hmm, looks like (from the point of view of an individual plaintiff), the lawyers are the big winners. Let's look at one where each plaintiff gets a bigger payout, like you say.
Ten plaintiffs, $10m judgment. The lawyer gets $2.5m, each plaintiff gets $(10-2.5)/10m, or $750,000. So the lawyer gets much more than any plaintiff. I guess we need bigger payouts per plaintiff.
Four plaintiffs, $10m judgment. The lawyer gets $2.5m, each plaintiff gets $1.875m. Still looks like the lawyer was the biggest winner.
Two plaintiffs, $10m judgment. Hang on, weren't we talking about class actions?
The fact is that it doesn't matter how big the settlement per class member is. If the fee is 25%-33%, the lawyer will ALWAYS get 25%-33%. It doesn't matter if each class member gets $250 or $250,000.
"The creepy guy across the rad is probably logging it all anyway, right?"
That may be - but if he got caught, he wouldn't be able to hide behind 'by mistake' or any other excuse.
Google got caught, that's what's the difference.
Also, do not forget, that you and me may know enough about hardware/software and how to configure our WiFis to be encrypted, password-protected, ...
But do not assume that most people out on the street would KNOW this, or even be aware of the problems connected with it - the law needs to protect those people, too.
If you enter someone elses house uninvited, but hey - the door was open - and then leave, while taking some fairly private details (copies of receipts, ... other information that might be relevant for ID theft). Do you really think, if you got caught, a court would let you get away with "well, the door had been left open...", or do you think, you would still get convicted (it wasn't your premises, you had no right of being there) - you might get some small relief out of the owner of the property not protecting it (by locking the door), but it would still be illegal to enter uninvited.
The same holds true for both the creepy guy across the road, and a multi-national like google.
The thing I don't get about google, is how they can claim that it was by accident. Sure, it was by accident, we started some software that would take dumps of data-packets and store them, when all they wanted to do was just take photos.
I would believe google just about that they didn't want to use the data to break into the systems of the people involved, but maybe to make up some nice stats of how many unsecured/unencrypted connections they found. But that wouldn't have required storing the data.
Example? Sit onto a bench in central park and drink a beer? Busted! This is perfectly legal in most of Europe. Another example? Drink a beer at the tender age of 17? In most of the US a crime in most of Europe wine and beer can be consumed from 16 up. In Switzerland a 17 year old boy can screw a 15 year old girl (or vice versa) without falling afoul against the law. Something, I would guess, gets you stamped as a felon and a sex offender agains kids for the rest of your life in most states
There's a whole damn library about privacy legislation throughout the EU.
Those binding directives must be implemented into law in all of the EU countries. You can add Iceland, Norway and Switzerland to the mix. This partially translates to criminal offenses if violated and yes - systematically storing and processing personally identifiable data without permission, reason and safeguards may be a crime depending on circumstances.
You may claim that this is stupid. I for one however rather sip a beer, sitting on a park bench on a sunny day then have my private data (including phone, financial and medical data) splattered around the world and sold to every sleazy marketoid that pays for it.
Your priorities may differ, of course.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
Just one of these stupid posts should be allowed per Google-SSID article. All the other ones are redundant.
Ok, why is this stupid? Because the entire world has grown up to understand the idea that there is a difference between doing something and doing something a lot.
There is a difference between peeking in a magazine and reading it at the store.
There is a difference between listening to music and listening to music at 100dbls in a party.
There is a difference between walking around naked in your house and doing so in your glass house.
There is a difference between selling your old computer in your garage and turning your garage into a used hardware store.
There is a difference between selling your 2 tickets to a concert you won't attend and selling your 100 tickets to the same concert.
In fact the whole RIAA has successfully sold (or rather bought) the idea that it is not the same to share a movie with your friend than sharing it with your other hundred thousand friends.
And yet you are unable to understand that there is a difference between broadcasting SSID and MAC addresses to let your equipment interoperate inside your home and volunteering them to a global geolocating database of the entire Internet!
And yet you are unable to understand that there is a difference to let your neighbors see your face and having an omnipresent and omniscient entity mapping and logging every detail about you!
These people didn't opt-in into this, they never even knew about it, and if they knew, they would have opted out.
Google is abusing both people's thrust in their neighborhood --who could have known that Google is watching you everywhere?-- and their ignorance. Is it ok to take something from someone just because they didn't knew they had it?
Google basically played "easier to ask forgiveness than ask permission". Are you really so incapable to realize the difference between an individual and a corporation?
But... the future refused to change.
Google is evil. Period.
Why do people insist in acting surprised when they find that Google can't be trusted. Google's object is to know as much as possible about YOU. They will find that out, then attempt to find ways to exploit that information without actually doing anything illegal. They got caught in this instance and realized that they should tell someone they did it rather than a whistleblower...which would have been even worse.
Greed = Google.
Just my $0.02.
-JJS