Slashdot Mirror
Google Describes Wi-Fi Sniffing In Pending Patent
theodp writes "After mistakenly saying that it did not collect Wi-Fi payload data, Google had to reverse itself, saying, 'it's now clear that we have been mistakenly collecting samples of payload data from open (i.e. non-password-protected) Wi-Fi networks.' OK, mistakes happen. But, as Seinfeld might ask, then what's the deal with the pending Google patent that describes capturing wireless data packets by operating a device — which 'may be placed in a vehicle' — in a 'sniffer' or 'monitor' mode and analyzing them on a server? Guess belated kudos are owed to the savvy Slashdot commenter who speculated back in January that the patent-pending technology might be useful inside a Google Street View vehicle. Google faces inquiries into its Wi-Fi packet sniffing practices by German and US authorities."
A patent?
Isn't that exactly the same thing which wardrivers have been doing since WiFi existed?
It seems there's one bit of Google that really wants to sniff packets and another side, probably PR, that doesn't want the bad press. At the end of the day they're now just another multinational corporation with potential markets rather than individual customers.
It's now termed as Wardriving
I am totally unconcerned with Google or anyone else collecting this kind of data. If you don't want anyone to know about your access point then stop broadcasting for hundreds of feet over public property. If you don't want me to decrypt your satellite feeds to get free TV then stop broadcasting it into my receiver on my property.
It's now "Wardriving -Beta"
No. That would be "GWardriving(tm) Beta"
My blog
operating a device — which 'may be placed in a vehicle' — in a 'sniffer' or 'monitor' mode and analyzing them on a server?
As scary as the poster tries to make this sound, this is how you listen for public access points. This post is a scare-mongering dupe.
Yellow journalism is getting to be awfully common here on Slashdot. For instance this troll of a story which just so happens to be from the same author:
http://developers.slashdot.org/article.pl?sid=10/05/21/1427245
Hm, my netbook + car charger + linux + aircrack-ng does just that.
My archos media player can do likewise.
How can you patent this crap?
--- Users are like bacteria -> Each one causing a thousand tiny crises until the host finally gives up and dies.
The patent is for capturing the metadata and analyzing it. Guess what the Google van was supposed to do? That's right: capture the metadata, and analyze it. Nobody's disputing that, nobody ever has disputed that.
The accidental part is that it turns out they were capturing more than metadata. The patent doesn't talk about doing that, there's no evidence Google ever intended to do that, and it's difficult to determine what they could possibly gain from it anyway.
So, here, let's improve the headline.
"Google Has Pending Patent For Exactly The Process They Tried To Implement, But Slightly Screwed Up"
SHOCKING!
Breaking Into the Industry - A development log about starting a game studio.
The patent, titled "Wireless network-based location approximation", describes packet analysis for determining location, which nobody denies was being done intentionally by Google, and says nothing of using payload data. This was what sparked the current wave of privacy inquiries anyway, as well as the incorrect comment that they weren't capturing payload data.
I think the original "by mistake" explanation they gave is a load of cr%p. How is it even possible to "collect WiFi information by mistake"? You have to install appropriate hardware and software, run it and then place the results to some sort of a database. Basic though it may be, someone had to do this, do this on all Google street view vehicles and keep it running. We are talking an effort of multiple people. There is absolutely nothing about it that's a mistake.
Now that they've been caught - they are resorting to bold faced lies.
Didn't have much trust in Google until now, but this has gone beyond anything acceptable.
But, as Seinfeld might ask, then what's the deal with the pending Google patent that describes capturing wireless data packets
The deal is that the patent describes capturing and analysing wireless data packets to extract the IP adress alongside GPS coordinates in order to enhance Google's IP geolocation accuracy. The "mistake" that they owned up to is actually dumping and storing all packets, not just the external IP address. Those are two different things.
There is no reading comprehension in the world, apparently. This patent is about what Google claims it was trying to do -- recording SSID and MAC information for location purposes. It has nothing to do with the "mistaken" data packets (sent unencrypted over the air). How the submitter connected the two, I don't know. I suspect lack of coffee and excess Google hate.
Put identity in the browser.
i realize that it may not be their intent to patent wardriving, but wouldn't that be covered by this?
There are some people who perceive an unlocked door as an "open door." This is simply not the case. A closed door needn't be locked to send the message that privacy may be desired. An open window is not an invitation for people to stare in from the outside, let alone climb into someone's home.
The point is, that even if it's not "locked down" and may even appear to be open, behaving this way in a residential area is tantamount to trespassing. The front door of a home may or may not be locked, but the act of testing to see if a door is locked or unlocked may be considered a crime. Actually entering a private residence after finding the door to be unlocked, whether by mistake or otherwise, is still an act of trespassing.
Doing all of this wirelessly certainly adds more physical distance in the act committed, but it doesn't change what it is.
An open access point in a business is often and mostly perceived as "free service." An open access point in a residence is not. I find it hard to understand why others may not see the difference.
Google is redefining the word Evil as we speak. Someone like Kevin Mitnick would be serving time if they were caught doing this.
So, what you're saying is, these people are tresspassing on Google's property by broadcasting data into Google's streetview trucks?
I can't see this comment of your making sense any other way, since system wasn't being interactive with the networks (ie: talking to them) to get the data, they were just recieving unencrypted broadcasted data.
Change is certain; progress is not obligatory.
He's scaremongering, like he does 99% of the time.
The other 1% he just gets it totally wrong.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
What's the big fuss anyways!
The legal idea of a man in the middle attack with nation wide premeditated long term personal for profit data retention.
Domestic spying is now "Benign Information Gathering"
Whatyoutalkinbout, Willis?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
It became elgooG?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Prior artists
Obi-Wan: "I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror and were sudden
excess Google hate
Will it be OK for us to hate Google once they've proven absolutely and undeniably that they are are evil? Or is it OK to start sometime before then? IMHO, a "Surgeon General's warning" ought to placed on everything Google does.
They were sniffing OPEN, unencrypted networks. I don't think anyone should go to jail or even be sued for that. If you don't want people accessing your traffic, encrypt it. I mean, I could see the argument that if you used *any* kind of encryption, even WEP (which we all know is easily broken), then you have a reasonable expectation of privacy, and if someone cracks the encryption, then they should be legally liable. But really, if you don't take any measures at all to protect your wireless network, then you have no expectation of privacy.
It's fair game for all the world, as far as I'm concerned. I don't see anything evil about that. That's like hooking your telephone speakerphone output up to a big-ass stereo, turning the volume way up, opening your windows, then complaining when passersby on the street hear your conversation.
and use Google's data to prosecute the owners of these networks since it's illegal to leave your WiFi unsecured in Germany. STATE POWER!!!!
I don't think Jerry would actually pose that question...
One group Google does not want to go against is GWAR.
http://www.gwar.net/
Who is John Cabal?
It's illegal in the UK
As I pointed out this morning here - http://theamericandictator.com/content.php/133-Google-has-created-a-virtual-GPS-on-YOUR-laptop-desktop-computer-cellphone.-Really! Google isn't collecting wifi info without a reason. It is collecting the data because it is using it create an unbeatable virtual GPS on every wifi equipped device - laptop - netbook - desktop - cellphone - etc. etc. And THAT data, delivered to google realtime, is also made available through an open API, to everyone. The social implications of having your physical location monitored, reatlime, all the time, is chilling.
if you are going to be evil, you will have to buy a license from Google.
if this is supposed to be a new economy, how come they still want my old fashioned money?
If you don't want me to decrypt your satellite feeds to get free TV then stop broadcasting it into my receiver on my property.
This argument becomes tiresome.
It was settled - legally - in the earliest days of radio, on the perfectly intelligible grounds that leeches undermined the funding of subscription services which might not otherwise be viable.
You were never entitled to freely tap into the water, power, sewer, and phone lines which might cross your property.
The carrier wave of the satellite broadcast falls on your property as freely as a sunbeam, a snowflake or a hailstone.
But to extract the content - capture and decrypt the signal - you have to mount a dish.
Install - and modify - a receiver.
To any other eyes than your own, it's a tap.
WiGLE
"Weak encryption" was the excuse for DeCSS's being broken and yet we all agree that it was an eventuality that any encryption would have been broken eventually and, in fact, if it were stronger, it would have made the prize all the more enticing. "Unencrypted data" is therefore an open invitation?
As I said in my piss poor analogy, just because someone has an open window, it is not an invitation for anyone to look in!!! This "expectation of privacy" stance is nonsense as regardless of the technical merits behind the discussion, technical merits have no influence over the perception of the general public. We have email that is all but completely unencrypted and yet we would all be pretty upset to find that some government agency or even a commercial entity would examine our email to use against us or for their own purposes.
There is not only an expectation of privacy, there is an expectation that people will not do things that the rest of the world finds questionable. And if you REALLY think your position is valid, I can only believe that everything you have is encrypted and that everything you do is hidden and that you are not vulnerable to anything. I'm fairly certain that is not the case. But if it were and I were to find a weakness or an oversight on your part, would it be fair to exploit your lack of knowledge or understanding of technology to my gain and your detriment and then tell you that you invited me to do it?
Here is a good technical description from a packet level:
http://erratasec.blogspot.com/2010/05/technical-details-of-street-view-wifi.html
The point is, that even if it's not "locked down" and may even appear to be open, behaving this way in a residential area is tantamount to trespassing
Using someone's service to actually send and receive Internet traffic is a completely different situation from analyzing unencrypted data packets. As in significantly different legal standards apply. In this case, it is ridiculous to consider passively listening to unencrypted traffic to be "trespassing", any more than parking on the side of the street would be.
I. As it happens, the Electronic Communications Privacy Act states "It shall not be unlawful under this chapter...to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public;" (18 USC 2511, 2(g))
The wisdom of capturing traffic from a system configured so that the communication is "readily accessible to the general public" aside, Congress certainly doesn't consider such things to be a legally prohibited privacy violation. Otherwise it could be illegal, for example, to listen to a CB ("citizens band") radio just because the conversation was not addressed to you.
Now as it happens, it is illegal to listen to phone calls on certain bands, and Congress has made such traffic not readily accessible by prohibiting the manufacture and distribution of amateur radios, etc. that can listen on those bands. As of yet, Congress has not prohibited the sale and distribution of wireless network adapters, however, nor prohibited such adapters from transmitting traffic "readily accessible to the general public".
II. Besides the ECPA, a much older law governs what you can actually do with the contents of wireless transmissions not intended for you. Specifically, you cannot disclose the contents to others, nor can you use them for your own private benefit (cf. 47 USC 605). So it would seem that Google can legally capture the traffic, but they can neither disclose it, nor use the contents even for their own proprietary benefit.
There is a specific exception to this provision for viewing unencrypted satellite transmission under certain conditions, but no visible exception for divulging or making private benefit of (unencrypted) wireless network transmissions.
I don't see how scaremongering and being wrong is mutually exclusive.
signature is pants
Nah don't worry, Google is your friend, your lover, your new red bicycle.
Trust us. We are not evil.
Those who eschew Apple just b/c they are on top, or b/c of some perceived wrong doing, Google knows when, where, and what your search, whom you talk to, where you travel, and in some cases what you buy.
"Unencrypted data" is therefore an open invitation?
I don't know where encryption works in to any of this, but yes. You broadcast unencrypted signals, you shouldn't be upset if someone has the gall to listen in.
And if you REALLY think your position is valid, I can only believe that everything you have is encrypted and that everything you do is hidden and that you are not vulnerable to anything.
My wireless network is encrypted. My personal files are on a system on my own network. None of this is open to the public. I have a reasonable expectation of privacy.
I run some personal sites dedicated to various hobbies / interests. Some of that content is open to the public. It would be silly for me to get upset and claim those files are there just for me and my hobby community and Google's spiders have no business crawling it (which they do). It'd be even more foolish for me to put my personal files there.
When did Google "deny" this before "reversing themselves"? They were asked to turn over data by the Germans (who have an irrational fear of having pictures of their houses taken). They looked at it first, realized there was more there than they had been intending to collect and to their credit, rather than try to delete or hide it, they announced it and issued a mea culpa.
Anyways, there's apparently no new news for this story included in the summary, so why are reposting and reshashing old stuff? This is such a non-story . . .
Once again, would it be fair to exploit your lack of knowledge?
The bigger problem here is that not everyone knows enough about locking their stuff down and they never will. It is an unreasonable expectation.
At any given moment, your guard may be down even if most of the time it is not. Is it then okay to exploit you when your guard is down for any reason at all? This is the basic question at the core of this issue. "Is it okay to prey upon the ignorance of the masses?"
Once again, would it be fair to exploit your lack of knowledge?
The bigger problem here is that not everyone knows enough about locking their stuff down and they never will. It is an unreasonable expectation.
No - it's not an unreasonable expectation. They may be surprised by how public they've been all along. I understand the feelings of shock and anger that can entail. But at the end of the day, the unreasonable expectation was that anything these people were doing in the clear on an unencrypted network was private.
At any given moment, your guard may be down even if most of the time it is not. Is it then okay to exploit you when your guard is down for any reason at all? This is the basic question at the core of this issue. "Is it okay to prey upon the ignorance of the masses?"
The very same systems I mentioned that Google spiders also contain controls that keep a certain amount of content private within said communities. If Google started running exploits against un-patched software to allow their bots to spider this content, you might have a point. But that isn't the case with my sites. Google's bots are only accessing what I have allowed anyone to access.
Now - if Google manages to index a personal file from one of those sites, it's my own fault. I can be embarrassed about it. And if I were less understanding of the technology, I might even feel upset and angry at Google. But I doubt anyone would claim that Google has exploited my lack of knowledge and placed an unreasonable expectation on me.
Keep in mind that, as far as I've read so far, Google is not indexing data from these wireless networks. They are picking it up as a byproduct of mapping them out. I've done the same countless times while wardriving using Kismet. Usually I just dump the directories. Once in awhile I'll go see what it was I've picked up. The vast majority is unintelligible junk - parts of a TCP session that has no interest. Once I picked up someone in a marina looking up a boat parts supplier web site. Another time, I picked up the credentials for a POP account. If I really wanted to get more data of that sort, I'd be better off coming back to the insecure networks and camping out for awhile. It doesn't sound like this is what Google is doing.