Google Found Guilty of Australian Privacy Breach

schliz writes "The Australian Privacy Commissioner has found Google guilty of breaching the country's Privacy Act when it collected unsecured WiFi payload data with its Street View vehicles. While the Commissioner could not penalize the company, Google agreed to publish an apology on its Australian blog, and work more closely with her during the next three years. Globally, Google is said to have collected some 600 GB of data transmitted over public WiFi networks. In May, the company put its high-definition Australian Street View plans on hold to audit its processes."

Comments

Mind Block

[Saeed al-Sahaf]

I really don't understand the issue: If you willingly radiate an unsecured Wi-Fi signal (or any type of signal), how can you claim a breach of "privacy"? *NOTHING* was "private"!

Re:Mind Block

[Animaether]

In your black-and-white world, I'm sure that things work that way.

In your world, you shouldn't complain about people taking pictures through your windows. You willingly radiate electromagnetic radiation - in the form of photons - so anything that can be seen through your windows is not private at all. Should have closed your curtains.

In your world, you shouldn't complain about people using parabolic microphones to listen to your conversations with another person in your household. You willingly make the surfaces vibrate, so anything that an outsider manages to pick up is not private at all. Should have use 2-foot thick reinforced concrete and lined the inside with sound absorbing padding.

In your world, you shouldn't complain if somebody goes through your trash and digs up everything from bills to medicine prescriptions. You willingly discarded it so callously, so it is not private at all. You should have incinerated it.

In your world, you shouldn't complain if private security companies band together and employ facial recognition among other to track your movements wherever their services have coverage, selling this data to yet other companies. After all, you willingly set foot outside. You should have gotten a teleworking job and gotten your groceries home-delivered.

Fortunately, in the real world, things aren't so black and white. Things are many shades of gray and probably all the colors of the rainbow, too. In the real world, we do define some rules, laws, that curtail these sorts of activities one way or another - generally in the interest of people's privacy.. even where in your world there would be none.
It is in that real world that Australia has seen fit to set privacy laws (Privacy Act) under which Google's activities are a no-no.

Whether or not those people should have known better, and should have secured their WiFi, or whether the people whose data has been collected even care that it occurred.. is a moot issue for the conclusion reached by the Australian privacy commissioner.

Re:Mind Block

[vlueboy]

Bravo.
The single problem with google's invasion is that they go beyond *my product spec* and extend the 50meter range of your wireless to worldwide distances, even if it's just a few useful bits. All without permission. People get sued for ignoring re-broadcasting "laws" here in the states.

Re:Mind Block

[wisnoskij]

Well it all depends on what senses you are using.
for example Google could get some x-ray/heat vision gizmo that allowed then to track peoples actions in their homes or a sound amplifier to listen into someones home.
While wireless receivers are a lot easier to buy, that does not mean they are fundamentally different.
Not that I did not share your opinion as a gut instinct.

Re:Mind Block

[DarthBart]

In your black-and-white world, I'm sure that things work that way.

In some cases, they do.

In your world, you shouldn't complain if somebody goes through your trash and digs up everything from bills to medicine prescriptions. You willingly discarded it so callously, so it is not private at all. You should have incinerated it.

Once it hits the curb for trash collection, it's fair game. Tons of legal precedents have been set for this. If I want to dispose of my accounting ledgers for my meth operation, I damn well better torch or shred them.

After all, you willingly set foot outside.

Yep. Just like not doing something stupid like logging into my bank account from the untrusted computer at the hotel lobby, I have no control of my surroundings and have no expectations of privacy. It is a jungle out there.

In the US, there are no laws against receving un-encrypted data or voice communications (other than maybe cellular, I don't know the exact laws for that). What's illegal is using the reception of those signals for personal/business gain or for assistance in commission of a crime.

Re:Mind Block

[Darkness404]

All your examples though require extra materials and a lot of time. I don't know of a single wi-fi router, even the ancient ones that don't support at least -some- form of encryption. Yes, it might be terribly weak and can be compromised by a cracker in a matter of seconds, but then the Google "problem" would be moot.

If I'm outside with a megaphone screaming a conversation from a driveway, can you really say that the conversation was private? Yet that is essentially what having an unencrypted wi-fi system is.

Your situations -might- make sense if it wasn't so easy to set up encryption! Soundproofing my house requires a large setback both in time, money and design. Not going near my windows requires a decline in what you can do with a house. What exactly is the drawback of encryption? There isn't any.

Re:Mind Block

[Zironic]

It's about reasonable expectation of privacy, not what's technically possible. Did you know that in many parts of the world people leave their door unlocked yet still expect people to not walk in uninvited? While many Americans seem to have a very free for all wild west attitude to these sort of issues many other parts of the civilized world expect others to behave civilly.

Private?

[www.sorehands.com]

I agree to a point. If you don't secure your connection and get sniffed, it is your fault.

The fact that Google snooped it does not make their actions any better. If they had snooped and only picked up SSID and Mac addresses, then that is one thing.

This may have served an important purpose, it woke people up about security on WIFI connections.

Re:Private?

[Charliemopps]

It's the equivalent of google putting a tape recorder in a public park in order to record bird songs and then some people happen to walk by talking about how they like to take it up the butt. Governments see google as an easy target. Simple as that. You are NOT safe on the internet. Suck it up. Your politicians, as usual, are lying to you.

Re:Private?

[Tharsman]

It's the equivalent of google putting a tape recorder in a public park in order to record bird songs and then some people happen to walk by talking about how they like to take it up the butt.

No, it's the equivalent of them driving with a huge audio amplifying system and recording private conversations just because you didnt bother to sound-proof your house. Any audio professional knows it's extremely easy to sound-proof your house, you saying you don't do this in yours? Then don't whine if some one records what you say in your house, you can't claim it's private if you don't use the technical tools available to you to protect it.

Also, please do ignore the fact they didn't just connect to unsecured networks: they capture all data from these networks they could and saved it. Didnt they tell everyone they were just taking photos?

Re:Private?

[Darkness404]

Then don't whine if some one records what you say in your house, you can't claim it's private if you don't use the technical tools available to you to protect it.

Soundproofing a house doesn't take 2 minutes and no extra material. If you could soundproof your house by flipping a switch, yeah, you would have some problems with it.

But it isn't even like soundproofing your house, having an unsecured wi-fi connection is akin to standing near an open window with a megaphone having a conversation, something like soundproofing your house is if you use weak encryption or common passwords, things that Google didn't bother to crack (and if I recall correctly, they didn't even intend to use a packet sniffer, it was just some debug code that got left in by mistake)

Re:Private?

[matunos]

Except in this case, it was apparently in violation of the law.

Re:Private?

[icebike]

Also, please do ignore the fact they didn't just connect to unsecured networks: they capture all data from these networks they could and saved it. Didnt they tell everyone they were just taking photos?

They did not connect to the networks.

They did not capture all the data from these networks that they could.

They drove by, captured a few microseconds of beacon data and random unencrypted packets. All they really wanted was the beacon data, to locate the wifi hotspot, but someone got sloppy in the packet filtration.

There was no Connection to these networks. There was no expectation of privacy. Don't try to make more of it than it was.

Re:Private?

[icebike]

If I go out into the street right now, guess how much traffic I could pick up? I see 7 access points here. In a suburb. From in my house!

So your neighbors are idiots.

I see closer to 20 access points with nothing but my smartphone.

How much traffic could I pick up with a good laptop? Probably Gigabytes per hour.

How much traffic could I decipher?

One house's traffic.

Because that neighbor, like your neighbors, is an idiot.

Re:Private?

[KDR_11k]

The law does not agree. Few people know about securing WLANs so it's not reasonable to assume every unprotected WLAN was set up with the intent of inviting you in.

Re:Private?

[BrokenHalo]

I see 7 access points here. In a suburb. From in my house!

Sure you can. No problem. But if Google had simply collected all the SSIDs of every WAP, that would not take up that 600GB of storage mentioned. So that implies that Google was sniffing a lot more payload data, and I can't think of a single legitimate reason for doing so. Simply saying "oops, it was a mistake, my bad" doesn't work for me.

Re:Private?

[KDR_11k]

I find this statement quite funny, as Slashdotters on average have no respect for the law, so stating its legal status holds no merit

What, in a debate about a country investigating a company? You think the investigators follow Slashdot instead of the law?

Regardless, your statement above is demonstrably absurd. The average cellphone user cannot disable GPS tracking, either. The average person cannot do a great many things when it comes to securing their privacy. Someone who uses these legal methods to accumulate this data (say, by tracking GPS positions using Google Latitude or other services) is not in the wrong.

Yes they are, unless they have specific consent from the user to collect that data they have no right to collect it. If it's generated by regular use of the service the data has to be destroyed, not stored. Only information necessary for billing can be stored by default and then only as long as they are necessary for billing/tax purposes, after that they must be destroyed. A person is allowed to look into the personal data held by a corporation on him (of course not free of charge) and correct it or have it destroyed. Last I checked laws were being implemented that prevent opt-in clauses for data collection to be a part of a non-negotiated contract that's primarily about something else (e.g. a contract to use a service, without that you can't use the service but the citizen must have the ability to use the service without opting into additional data collecting). EULAs are invalid in Germany so that doesn't work either. There are also a ton of sanctions on the data including not exporting it to countries that don't have such strict data protection laws without voluntarily obeying EU data protection laws there too.

As you can imagine a company like Google that's specialized in gathering personal information about people isn't terribly popular with the agencies in charge of enforcing data protection laws.

Let me get this straight..

[Techman83]

It's not ok for google to inadvertadly capture minute packets of useless information, but it's ok for the government to direct ISPs to intercept data illegally.

The Australian Labor party have time and time again broken their promises, Barging ahead with Policies that their citizens do no want and completely fucking up things they tried to achieve

The only reason Google are in hot water is because they stood up to Senator Conroy and he got upset about it.

I for one will be making my vote count this year and I urge all fellow Australian slashdotters to do the same.

Re:Let me get this straight..

[houghi]

It's not ok for google to inadvertadly capture minute packets of useless information, but it's ok for the government to direct ISPs to intercept data illegally.

Why is it that people keep thinking that this is something between Google and some Government? This about your privacy. That means BOTH can be wrong.

Re:Gotta love our stupid laws

[ILuvRamen]

okay, so walk around an entire city while detecting and recording all sound, digital transmissions in all forms, and all analog signals too. Yeah it's "public" because it's floating through the air but you're still just walking around, spying on random people and that's frowned upon legally in most countries. So any fraction of that like just recording open wifi data is also illegal. That's the logic behind it at least, it's still stupid.

Wait for Google's appeal, if any.

[freddienumber13]

Were you given the same evidence to consider as the Australian Government?

Or are you just making blind assumptions about what you think happened vs what really happened according to the evidence provided by Google to the Australian Government?

In other comments on this activity, it appears that you are wrong and that Google *did* actually connect to private (even if insecure) networks and *did* collect more than beacon data.

If you have evidence that can show that Google did not collect personal data, by all means share it.

Note, that Google worked with the Australian government and undoubtedly handed over whatever data it had collected. I'm pretty sure that the Australian Government would have handed the data to people familiar (if not experts) with this type of activity and asked them to analyse it. Thus the "guilty" is quite likely founded on real evidence, whereas your post is likely based on speculation.

If Google is not guilty then I'm sure they will appeal this to the courts. If they don't then that is Google agreeing with the Australian Government and disagreeing with you.

Re:Wait for Google's appeal, if any.

[icebike]

Google has publicly stated that they did not connect. Its in their blog post months ago. Its the same thing they told governments around the world.

Are you now claiming access to some other admission? If so lets see it. If not, just admit you made it up and we can be friends.

They drove by at about 25 MPH. You really can't connect to a router that fast when the average router has a range of about a hundred feet thru walls.