Slashdot Mirror
Google Street View Wi-Fi Data Includes Passwords, Email Content
snydeq writes "The French National Commission on Computing and Liberty has found passwords and email messages among the Street View Wi-Fi data Google intercepted, InfoWorld reports. The data protection authority has been investigating Google's recording of traffic carried over unencrypted Wi-Fi networks. Google has said it collected only 'fragments' of personal web traffic as it passed by because its Wi-Fi equipment automatically changes channels five times a second. With Wi-Fi networks operating at up to 54Mbps, however, those 'fragments' may have been more than that. 'We can already state that [...] Google did indeed record email access passwords [and] extracts of the content of email messages,' CNIL said."
If you're stupid enough to access information you care about and wish to keep private via an insecure link, then you're asking for trouble.
This went from "it was an accident" to "there's nothing in the data anyway" to "hey, will you look at that! How'd that get in there??"
It's not that I think everyone should be forced to use encryption everywhere, but in this case the unencrypted data is being broadcast out into public spaces.
A crapload of small random bits of data will contain some interesting data.. This is news?
If you don't want anyone picking up your wifi traffic you encrypt it. Welcome to the year 2000.
Blessed are the pessimists, for they have made backups.
that this would end up being less about Google getting in trouble for scraping unsecured data and more about educating the general public on how to secure their networks. Aside from the fact that Google probably shouldn't have done it in the first place, this should be wake up call to everyone with an unsecured wireless network.
Maybe someday people won't be stupid enough to transmit passwords in the clear and expect privacy. It's not like the technology to do it doesn't exit, people are just too resistant to chance and "inconvenience".
A man can dream though, a man can dream...
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
It wasn't intercepted between the sender and recipient.
The sender sent it to the recipient, AND ALSO broadcast it, over the air, in the clear, to anybody who cared to listen.
People should realize that everyone can do this, it's not some multi-million dollar decryption device Google built. So instead of pointing the finger at Google for perhaps "something bad" they did, it's more wise to start educating WiFi operators about the dangers that come with opening their networks, perhaps "something good", but it can be abused.
It doesn't matter.
The ECPA does not distinguish between wired and wireless communications.
--
BMO
Those people were transmitting those passwords and e-mails in the clear over a broadcast medium (ie. to everybody in range who was listening). Google was in range and listening and heard them. That's like saying "I was shouting my password at the top of my lungs on the streetcorner and someone overheard me and wrote it down!": yes there's a problem, but it's not with the person who wrote the password down. It's with you, for thinking you can shout things in public and somehow miraculously have them remain private and confidential.
Excellent point that it's hardly Google's fault that my ISP doesn't provide an encrypted connection to its email servers. I'm looking at you, Time Warner. (And NO, webmail doesn't count.)
The ISP is responsible for this problem, not Google.
On further thought:
The only thing I can see that might make it legal is that all wireless routers are Part 12 devices.
But then you're pitting one federal law against the other. Who wins?
--
BMO
Where can you even log in any more with an unencrypted connection?
The law doesn't care.
Stop thinking about your Wifi device. You emit a lot of information without knowing about it anyway. Read about TEMPEST.
Some people even believe that just cause they have swapped CRTs with LCDs, they are not vulnerable. They are usually wrong.
There are way many things that are private to you, but that anyone can collect on a mass scale and raise hairs. Like the time period during which your home's lights are on, and when they are off, the contents of your trash, what type of car you use, what colors/types of clothes you wear, etc. just by noticing you in public. Not all such information may be useful or cost-worthy to use today, but it's all information that says something about you.
Banu
So, um, you're going to go after the drivers and not Google itself?
Coward.
--
BMO
The ISP is responsible for this problem, not Google.
Since when is it an ISP's responsibilty to secure their customers' wireless LANs?
I was wrong, not part 12, Part 15.
FCC Part 15 rules for consumer, unlicensed radio devices.
http://en.wikipedia.org/wiki/Title_47_CFR_Part_15
--
BMO
Since many ISP's offer to come set everything up for you when you sign up.
It doesn't matter.
Why not?
The ECPA does not distinguish between wired and wireless communications.
So, if you were to see me walking down the street, I yell something to my friend and you can't help but overhear it, you're guilty of a felony?
I think I'm gonna need some proof of that. (And not just the law, but a legal opinion.)
So someone talking on a payphone can send you to jail for walking past him with your tape-recorder turned on?
The ISP is responsible for this problem, not Google.
Since when is it an ISP's responsibilty to secure their customers' wireless LANs?
1) Since they started selling wireless LANs to their customers.
2) I'm not talking about wireless, I'm talking about unencrypted access to email servers, which should concern you even if you DON'T use wireless, for the same reason you shouldn't perform financial transactions over an unencrypted connection.
3) Using wireless encryption may be a good idea, but that is NOT enough to provide safe electronic communication.
But then you're pitting one federal law against the other. Who wins?
--
BMO
Conflicting laws are new?
But then you're pitting one federal law against the other. Who wins?
Your legal team's brokers.
So if I'm in my house, and I start signaling with the blinds in Morse code, something like "Hey look at me!" or even "SOS", then anybody who interprets those signals is a felon?
Not if it occurred in Europe, since the ECPA is US law. Doesn't apply in the US, either; by the terms of the ECPA a unencrypted wifi signal is "readily accessible to the general public", and thus not covered. (See 18 USC 2510(16), and 2511(2)(g)(i))
For those that believe that everyone should know about wireless encryption, and that everyone should know the benefits of WPA vs WEP, I hope you don't shred your trash but burn it before putting it into your recycle bin/garbage can. Because your credit card receipts and bills, even if shredded could contain "fragments" of personal data.
What you don't burn it or dissolve it in acid? You only shred it? You should know better. Everyone should know proper sensitive documentation handling and disposal procedures.
Care to name a few other areas that Grandma should know about which are blatantly obvious to you because computers and networking is part of your job. I bet Grandma doesn't throw you under the proverbial bus because you cannot sew a button on your shirt.
And what communications law would that be? I'm curious about how the law manages to say that broadcasting your data, in the clear, to anyone who cares to listen results in that listening party being in violation. Maybe you're not going far enough. I hear there are devices called radios and televisions that "listen in" on transmissions promiscuously broadcast by various entities. You should start grabbing people who operate these devices as well, I mean really, who gave them permission to collect the data put out by these so-called "broadcasters", did they check first and ask permission to eavesdrop on their signals?
Yeah, I hate it when people go around, just willy-nilly looking at things that are out in public. That just sucks.
See above. They're listening to publicly broadcast information. They're not breaking into your network, you're putting this stuff out there for all the world to see. The simplest way to stop them from hearing it is to stop broadcasting it, or encrypting those broadcasts.
Noooooo, I can't imagine where people might get that idea.....
Yeah, they got into a crapstorm with China, but it's you and your Georgia law-enforcement associates that're really gonna scare 'em.
There ya go, grab the guy getting paid by the hour to drive around. That's much easier than going after the actual company. If that's your strategy, you're lazy on top of being clueless.
Some bring out the best in others, some the worst. Some bring out far more.
In many states, yes. Many states have "wiretapping" laws that make it illegal to record a conversation unless all parties are aware that it is being recorded. This is increasingly being applied to public spaces as well. There's a high-profile felony case in Chicago about this right now.
Socialism: a lie told by totalitarians and believed by fools.
Bad analogy there - in general, if I do something with the reasonable expectation of privacy, and you listen in, you're probably breaking some law even if it's really easy to listen in. The technical difficulty of overhearing is not at all relevant.
Socialism: a lie told by totalitarians and believed by fools.
Such as only one those technologies work with my Nintendo DS, which is why I don't use the other.
Change is certain; progress is not obligatory.
Only... it turns out it is. See my cite of 18 USC 2510 earlier. This probably doesn't invalidate the first part of your statement, as it is likely that transmitting things unencrypted on a radio channel does not result in a reasonable expectation of privacy.
The odds of grabbing passwords in this way (changing channels 5 times per second and only being in range of a network for a few seconds at a time) is pretty slim, in general, but given that Google was apparently running this software for years it's not surprising that it happened occasionally. Still, the total packets collected only amount to like 660 gigabytes -- that's not very much, and I'm willing to bet that only a tiny, tiny, percentage of that data is this sort of data. Most of your traffic is not plaintext (even if its unencrypted). Heck, even if someone was browsing the web, you're far more likely to see a snippet of a jpeg or embedded Youtube video than HTML. With just a few packets, that's likely to be gibberish.
Old-school radio channels are unrelated to wifi hotspots in term of judging a user's intentions - different use models, and different level of sophistication of users.
Socialism: a lie told by totalitarians and believed by fools.
The Electronic Communications Privacy Act does not attempt to distinguish between "old school radio channels" and "wifi hotspots". The criteria for a radio communication "readily accessible to the general public" and thus unprotected are listed in the law, and they apply to WiFi hotspots.
I'm fairly sure I picked it up at some random site along the way, and I couldn't even tell you when. If you search google for it, you can easily find it in joke emails dating back from 2001 at least, and no attribution in sight. I'd say go ahead and do whatever you want with it.
Blessed are the pessimists, for they have made backups.
If I decide to start broadcasting information to the neighborhood via my shirt that is going to cause me to lose my shit and start threatening lawsuits because my shirt button wasn't properly secured then Granny is free to fire away.
Ah yes, the "Psychic Detection of How Much of an Ignorant Dumbass the Other Person Is Clause." Almost worthy of a semester of study by itself.
I heard fragments of the conversations of people in front of me in line the other day... didn't these people have the same "reasonable expectation of privacy" as the people shipping their data over open WiFi routers?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Mod parent up Informative.
http://www.justice.gov/criminal/cybercrime/18usc2511.htm
By the way, that page benefits *enormously* from Readability.
http://lab.arc90.com/experiments/readability/
Funny, the cordless telephone provisions are... uhmm... interesting. Does that mean that cordless phones enjoy the same protections as cellphones? What?
--
BMO
You cannot judge IT things by non-IT things. We need new laws that cover all of this shit.
QFE. An Insightful AC, a rare thing indeed :)
"Please describe the scientific nature of the 'whammy'" - Agent Scully
Perhaps this 'ECPA' law is stupid and needs revising? Or perhaps the law is more subtle than you're representing?
If I broadcast something on the radio, my intention is for it to be received by anyone within range. If that's not my intention, then I've made a fairly foolish choice of medium.
There is nothing interesting going on at my blog
Sadly... the same applies for me.
However, I find I'm using my DS online less and less, and am considering switching over to WPA (or WPA2, whichever all of my roommates and my other devices support... PCs, Wii, Xbox 360, and PS3)
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
You cannot go to BestBuy, buy a laptop, turn it on and walk down the street and record what google did.
You can do 90% of what google did. You CAN go to BestBuy, buy a laptop, download a program, turn it on, walk down teh street, and record what Google Did. Google did it with their own proprietary stuff to help integrate it with Google maps, but the information they recorded is by and large VERY easily obtained. Like, for under $250, easy.
People who configure their wireless access points to be unencrypted don't have an expectation of privacy. If they do, they're incompetent, and I'd rather we didn't have a legal system that strives to protect people who deliberately buy equipment and then are too stupid to use it properly.
There is nothing interesting going on at my blog
Its a weak analogy and its never used correctly.
Nonsense. The router is broadcasting in the clear into public locations. It's trivially easy to add encryption, which would have kept this information out of Google's hands. Refuse to do so at your own risk.
true, but irrelevant. You have to take deliberate action to walk outside and hear your neighbors talking, that doesn't make walking outside wrong.
I can do all of this on my freaking cell-phone. Where on Earth did you get the idea that you need some kind of "special equipment" to "hear" wifi signals, other than a wireless nic of some kind.
Some bring out the best in others, some the worst. Some bring out far more.
And if my grandmother bought an access point back when they were unencrypted by default and she's still using it?
Socialism: a lie told by totalitarians and believed by fools.
BULLSHIT
my bog standard laptop running free software can capture everything they captured.
They have to take deliberate action to record the traffic if they want to build up a map of networks in different places.
They absolutely can walk down the street and just "listen to it".Anyone can.
They do not have to have a special application and computer system setup and running to record it.
You absolutely can go to BestBuy, buy a laptop, turn it on, download a free app and walk down the street and record what google did.
There is nothing accidental about it at all.
they had perfectly good reason to record data on when and where packets from different networks was picked up, their only screwup was to retain the whole logged packets rather than discarding them later and keeping only the headders.
that so many people on slashdot would simply give Google a pass for eavesdropping on most of the civilized world. And anyone that actually believes this was an 'accident'... I have 3 bridges and 2 castles for sale on Ebay, please check them out. Google made a premeditated decision to collect Wifi data including passwords,emails, chat conversations, etc for 3 years. When they finally got there ass busted in Germany they try to brush it off as they were as much a victim as anyone else. Google's primary business model is to exploit the naive all the while maintaining that there 'not evil'. At least when you make a deal with the devil you know he's gonna fuck you in the ass.
Or you could just err on the side of not listening in on a conversation if you're not sure it's meant to be public.
Socialism: a lie told by totalitarians and believed by fools.
Bullshit. You're being intellectually dishonest.
Google picking up packets is not the same, even remotely, as rifling through someone's trash. Grandma, if she understands the concept of a password, knows to not write it on a sign in foot-high letters and stick it on her front lawn.
Since everybody is getting their analogies wrong, here's an identical situation: You've set up an AM radio station to talk to your friend across town. When you tell him about your sexual exploits, somebody tuning across the dial hears you. Do you get pissed and lawsuit-y because of it? Because that's exactly what having an unencrypted network is, just with somewhat less power and on a different frequency, plus some headers. It's not even an analogy, they're the same thing
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
And if her dishwasher has it's default setting of hyper-electricity-usage and she doesn't know how to put it into economy, should it be the manufacturer's responsibility to pick up the excess power bill?
It's not exactly beyond most people's abilities to ask for help in setting things up they don't understand. I usually find the manual a good place to start.
There is nothing interesting going on at my blog
So out of many gigabytes of accidentally-collected data...
It is so unlikely - essentially zero - that they "accentually" collected this data. That statement is pure bullshit. But as you say, it was out there in the air unencrypted...
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Make sure you go after everybody who has ever logged into an FTP server with the username 'ftp' and the password 'ftp'. After all, there's no way we can know if the person who set up that server intended it to be publicly accessible...
(You idiot...)
I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
Many as in 'not most'.
I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
Not closing my curtain allow you to see in my house but that its not ethical (may be legal still though)
to put a video camera and record the going on
Do you seriously believe that your "gmail" account, which is provide by, you know, Google, could not be accessed by Google anytime at all, regardless of their druve by WiFi shenanigans? You've already put yopur trust in Google by accepting an email account from them in the first place.
How about a moderation of -1 pedantic.
They stored the RAW data that had been sent. the raw data CAN include emails and passwords. How did that genius think, how logging into webservices worked internally?
oh and please tell me, how a PASSIVE wlan sniffer (Kismet) can "intercept" transmissions...
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
"hey had perfectly good reason to record data" does not mean legal right to.
As for "screwup" as noted it costs real cash to set up and test this equipment.
Someone gave the ok for this ie passed it for use knowing local laws.
Domestic spying is now "Benign Information Gathering"
It's stupid of me to leave my door unlocked, but if you walk right in and start taking stuff it's still wrong.
Yes, it was foolish to log all data without filtering it for just what they need, because even members of Slashdot are too stupid to realise what they actually use it for. It is arguably the most brilliant use of Wi-Fi technology ever, and yet, thanks to all of you, it will quickly become useless.
What confuses me is that Google never seemed to announce very loudly what their intentions were (fast, accurate locations), or alternatively, all the journalists disregarded this and cherry-picked quotes that make Google look bad.
Why was Google collecting any data at all? If they were trying to log locations of WiFi hotspots, surely they'd have asked themselves "what are the privacy issues of doing this"? I mean they are somewhat tech-savvy, and would know what information WiFi networks can send. So what could possibly be the legitimate reason for this? Not everyone (I'd say hardly anyone) would actually want their WiFi hotspot published on Google Maps, even businesses who give it free to customers.
Secondly, all I see is tech-heads saying "well don't transmit it, if you don't want it used!" That's pure hypocrisy, particularly from techies, who would be the first to protest if someone used a photograph they took for some commercial use. "That's copyrighted!" they would scream, and rightly so. So *who does your network data belong to*, even if it is open transmitted, as is that photo you uploaded? Isn't *any* data I create (an email, a password, an SSID) also copyrighted by my creating it? If not, why not?
I don't believe wiretapping laws apply here. There's a difference between recording a conversation between two people, and recording one side of a conversation. You are free to record yourself having a telephone conversation with someone else, without notifying the other party, so long as you don't capture their side of the conversation.
However, states have other privacy laws, wholly independent of wiretapping laws, that usually forbid the capture of any private conversations (e.g. audio bugs on a restaurant table) without notification/consent. That's why security cameras don't usually record audio.
Don't access points make this really easy, and really clear when you open the box and set it up? The last AP I bought had a large red sticker on it warning about unsecured networks, and the AP's setup went right into securing the AP. If "Grandma" is setting up her own AP, she'd have to go out of her way to keep her network unsecured. Odds are, it's her 12-year-old grandson doing the setup, and he just doesn't want to mess with passwords. That, or they own some device that doesn't work with WPA/WEP, so they unsecured the network out of necessity, but then they've made a conscious decision to do it.
99% of what they should not have sniffed was moving to or from a Google server anyway.
sau!
You know, call me naive, but I kind of like Google and I mostly trust them. They are obviously NOT using every last exploit of personal data or their technology to make a profit and ruin competition, and that's why people like them. People already trust them to vault loads of sensitive data. If this was Microsoft I might be more concerned, but maybe it's also Google's way of WAKING PEOPLE UP about leaving their networks open to anyone, including people you really can't trust, not just Google. (Microsoft weenies please post your irrelevant responses below where they can be ignored)