Slashdot Mirror
FCC Investigating Google Street View Wi-Fi Data Collection
adeelarshad82 writes "The Federal Communications Commission is looking into whether Google's Street View Wi-Fi data collection violated the Communications Act. At issue is a May admission from Google that equipment attached to its Street View cars collected data that was traveling over unencrypted Wi-Fi networks, known as payload data. At first Google said it did not know if that data included personally identifiable information, but the company admitted last month that it did include entire e-mail addresses, URLs, and passwords. Google has pledged to work with the FCC."
Why would they even REMOTELY think this was a good idea? What's the point of Google collecting this kind of information
Living With a Nerd
I was under the impression that amassing and organizing as much information as possible was part of their goal. There's lots of information to be had from router data. Perhaps it really was unintentional that they collected the extra personal information and that they only were interested in SSID, MAC, encryption, etc.
If by "work with them" you mean "pay them off," sure.
Forget the information contained in the networks, even since street-view came out I thought it was a shame they didn't list wifi networks with gps coords, encryption type, signal strength and the detection date. It was neat seeing my house one google maps but I'd be more excited to see my network signal. :P
check out the Mp3 Garbler I built!
Why climb Everest? Because it's there!
Why not? If it is public data and it might offer some additional correlation for geographic/text search engine cross-over then I for one would be interested in using that information.
A better question is, why the hell do people feel comfortable putting PRIVATE data on an UNPROTECTED network?
Oh, and just to keep it fun, the GOP is turning this into a smear campaign against President Obama by saying that there was collusion between the Whitehouse, Google and the FCC to turn this into a cover=up. Just wait until the lying heads at Faux News start spouting their twisted stories
Wherever You Go, There You Are
Even giving them the benefit of the doubt and agreeing that the collection of personally identifiable information was an accident, what do they need MAC adresses and SSIDs for? Some kind of searchable database for open WiFi no matter where you are? That's not a lawsuit waiting to happen, no sir...
Living With a Nerd
Access point MACs, signal strength, and latitude / longitude coordinates gives you a geolocation database you can use to calculate your position via WiFi, ie: skyhook.
The software they used was had a log of the traffic data. They did not know about it, they didn't plan to collect it. And the moment they found out about it they told everyone. If they had just silently deleted it no one would have known. But Google felt it was best to be open about their mistake.
I can't say what they wanted, that's just a guess. A MAC address would at least give away the manufacturer. But that's conjecture. It is possible that someone fudged some code and accidentally collected personal information instead of discarding it. It happens.
so they could sell it to fed's?
If the wifi is open then google can't be in trouble for using the wifi. Whats stopping me from going on my neighbors wifi and using it if it's open. Open Wifi is an invitation to use. Now if google cracked the wifi then ya I can see the FCC being pissed, but they only used open wifi.
Why is it illegal for Google to listen as it drives down the street to something you're broadcasting into the street?
Make it illegal to broadcast it into the street in such a way that a normal consumer device won't hear it, THEN you can go after Google if they used something to cheat and listen in on people.
Right now they're being investigated because they drove down the street with a microphone and recorded all the idiots shouting out their private info to anyone willing to listen ... without special listening equipment!
I understand making it illegal for someone to use a laser mic to listen to my private in home conversations. I expect anything that normally would not be heard outside my home to be private.
Wifi most certainly is expected to be heard outside the home. Its not something that someone can claim ignorance on, people understand that television broadcasts and radio broadcasts travel many miles, so anyone claiming ignorance just doesn't count as they are too stupid to matter.
I really can't see how you can call google wrong in these case, if you broadcast it over the airwaves, and someone hears it, too damn bad. Encrypt it, or hell at least use WEP, where it might not be actually secure, but at least you can say you made it clear it was not intended for unauthorized parties.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
There has been speculation that the software that they were using collects this data by default or that it is an setting that is easy to turn on without realizing it. I really don't get it, this is like complaining that the guy with his finger on the nuclear launch button brought a butter knife to work. For what possible reason would Google collect this information on purpose? The payoff is zilch, and the risk of backlash is huge. Everything points to this just being a stupid accident.
Why would they even REMOTELY think this was a good idea? What's the point of Google collecting this kind of information
I think they proceed from the philosophy of "it's easier to ask for forgiveness than permission". They are, after all, a corporation and therefore unlikely to suffer any penalty worse than a slap on the wrist. Individuals who might face real jail time tend to think it's easier to ask for permission than for forgiveness.
It is a miracle that curiosity survives formal education. - Einstein
The point of collecting information on wifi hotspots is to do more accurate geospatial targeting. Mapping IPs to lat/long is very coarse, since it maps to your ISP. With a database of wifi hotspot locations you can do much better. And given that they're driving around anyway to take street view photos, it doesn't cost Google anything to collect this data.
Now about recording the text information traversing unprotected hotspots -- which is the part of this that has people concerned -- that apparently was unintended. The explanation given by Google is that they were using some open source library that by default logged this information. Honestly I don't see that it would do them much good to do random packet sniffing like this, so I personally can't see a nefarious motive here although I do know we have some paranoid people in our midst.
There's *actual* crime happening every minute of every day online and this is the target the FCC is wasting its time and resources on?
Come on. Google effed up. They admitted they effed up. There's absolutely no evidence that Google did anything or was planning to do anything with this data and all available evidence points to a mistake rather than anything "evil". And besides, if you don't want your data sniffed, THEN ENCRYPT YOUR STUPID WI-FI CONNECTION!
Please FCC... we pay your salaries. Go after some actual fraud attempts rather than wasting your time (and my tax dollars) on this.
-S
--- What parts of "shall make no law", "shall not be infringed", and "shall not be violated" don't you understand?
They didn't think about it at all. They just wanted SSIDs and MACs and the payload data came along for the ride. They obviously didn't think it would be a problem, and why would they? Everything they collected was transmitted in the clear on unregulated spectrum.
Give me Classic Slashdot or give me death!
In the spring Google said that they had collected a vast number of random 200ms snippets of encrypted data. Obviously this will include passwords, e-mail addresses, band account numbers, and anything else you can think of. Google tried not to talk about that aspect of it, but they didn't deny it - how could they. So how is it a revelation that, last month, they were forced to make an official statement of the obvious?
I feel like I've been reading stories about this incident every week since it was first revealed last spring. Most of the ones in the mainstream press are confused (Wi-Fi data collecting versus StreetView) and totally paranoid (in the Google is reading your thoughts vein), and very repetitive.
So who is keeping this going? Is it Google's competitor's? Or is the law firms that are pursuing the extortion lawsuits? There are legitimate issues here, and legitimate law suits, but these endless ridiculous stories are not helping. They are just part of some P.R. battle.
Having played around with various wardriving tools, it seems to me it would be really hard to accidentally capture packet payloads.
The software they used was had a log of the traffic data. They did not know about it, they didn't plan to collect it. And the moment they found out about it they told everyone. If they had just silently deleted it no one would have known. But Google felt it was best to be open about their mistake.
Your last point is highly debatable. Google only went public with this after the German government demanded to audit the data even though Google assured them that no private information was being collected.
From http://lastwatchdog.com/googles-wifi-data-harvest-draws-widening-probes/ (this was covered many places in European press)
In April, Google admitted to German privacy regulators that vehicles specially-equipped to systematically shoot photos of street scenes for Google Maps also carried gear to collect data moving across unencrypted wireless networks situated inside homes and businesses. The company insisted at the time that only basic Wi-Fi location data was being collected. But after Germany requested an audit, Google subsequently disclosed that it had mistakenly collected personal data, as well.
I wish I had mod points right now... If you've used a Google product that told you your location without GPS or a cellular signal, you have benefited from their Wi-Fi data collection.
However, I can't condone collecting "payload" data - only MAC and SSID.
retrorocket.o not found, launch anyway?
Duh! It's Street View! You'd think they'd KNOW where they are! :) In all seriousness, they should have used GPS and this would have been a non-issue. Sad thing is, this kind of thing gets people in criminal court but will likely get Google a mere fine.
And look, now we have GoogleTV!
He who knows best knows how little he knows. - Thomas Jefferson
Read their justification here: ...urging a thorough investigation of both Google Street View and the FTC’s recent conduct during its investigation of the program. Click here for a 6-page pdf of the letter that includes additional background on Google’s extensive and close lobbying connections with the Obama Administration.
http://www.nlpc.org/stories/2010/11/10/congress-must-investigate-google-obama-ties
Who is the National Legal and Policy Center?
http://en.wikipedia.org/wiki/National_Legal_and_Policy_Center
The National Legal and Policy Center (NLPC) is a right-leaning 501(c)(3) non-profit group that monitors and reports on the ethics of public officials, supporters of liberal causes, and labor unions in the United States.
Just wait until Rush and Faux start spinning this, this will take on a life of its own
Wherever You Go, There You Are
Except that Skyhook does not send a vehicle through your neighborhood to collect the information, unrequired; they calculate it and store it as part of the location-detection service that the user initiated.
So, if I access Google and request location information, then it's fine for them to catalog my MAC address and Wi-Fi network information in order to properly and accurately provide the service. However, if I don't use Google, I do not want them cataloging my network information, uninvited.
-dZ.
Carol vs. Ghost
Total information awareness?
Just MAC and SSID? Well, you might be interested in the fact that the MAC is pretty much a vendor-specific ID, meaning that in most cases you can correlate the MAC to a vendor and model. What this means is that by collecting MAC addresses you can build a database of router vendors and models.
Manufacturers and retailers will then beat a path to your door to buy that database for marketing purposes. That is the true value of collecting that information.
Absolutely Google sells data like this and makes plenty from it.
You need to examine Skyhook's web-site more closely...
http://www.skyhookwireless.com/howitworks/coverage.php/
"To develop this database, Skyhook has deployed drivers to survey every single street, highway, and alley in tens of thousands of cities and towns worldwide, scanning for Wi-Fi access points and cell towers plotting their precise geographic locations."
Hey, you have something to hide?
But it's funny how governments are all up in arms over this. Maybe they don't want people to know that clear, unencrypted WiFi connection is easily recorded? I can't even remotely think they are for privacy - the naked x-ray body scanners, intimidation and downright sexual assaults happening at the airports clearly show that government doesn't give a shit about privacy.
I stand corrected. They both are eh-veel!
-dZ.
Carol vs. Ghost
Mission Complete, Sirs!
Here's the data you requested. [Publicly hands over captured WiFi data.]
It's been a pleasure doing business with you.
We're looking forward to completing many successful missions for you in the future.
But what harm is there in that really. So manufacturers can better target their advertising to places where they think they can gain market share. That's really not a problem where I sit.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
I have a real problem with a technically-minded company like Google "accidentally" logging that kind of information. Even if it was an accident, they need to be punished for that through fines or something (as other companies have been punished for their privacy breaches), and the FTC's ending of its inquiry solely based on Google's promise to do better next time was bullshit.
You have to hold companies with this much power and information accountable. Basically, you have to keep them in line and remind them to be on their toes at all times.
That's a big problem for Google, then. They need to start thinking about this shit.
Actually, the Communications Act prohibits the use of public radio waves in that way.
than a real investigation, given the most-favored-fundraiser status of the Google upper echelon wrt Democrats. Don't get me wrong; other than pitching a fit about the party opposite getting more cash, the GOP obviously doesn't give a care about corporations spying on US citizens either.
They didn't do it on purpose.
"Quite simply, it was a mistake. In 2006 an engineer working on an experimental WiFi project wrote a piece of code that sampled all categories of publicly broadcast WiFi data. A year later, when our mobile team started a project to collect basic WiFi network data like SSID information and MAC addresses using Google’s Street View cars, they included that code in their software—although the project leaders did not want, and had no intention of using, payload data. "
In other words, they did what every other software engineer does: they reused old code to get a job done. This time the code happened to have a bug in it, or rather an unintended consequence, that collected snippets of people's personal information as the vans drove by people's unencrypted wifi connections, which they've since publicly admitted and gone on to delete, or at least they would have deleted it except now they can't because all the lawyers have gotten involved and want to extract money/publicity to themselves by suing Google.
The whole thing is a giant tempest in a teapot. Even worse, it's a major distraction from real, more important, privacy issues.
Got a cite for that?
Who wants to bet that when you use Google Checkout, all your payment information gets accidentally logged as plaintext somewhere as well?
There's no reason to think they thought it was a good idea. The explanation they've given, which also happens to be the most plausible explanation, is that it happened due to being the sniffer's default setting.
If you're going to ask that question, you might as well also ask why did the broadcasters think that broadcasting this was a good idea? What's the point in giving your IMAP login name and password to your neighbors and anyone who happens to drive by? If that's your plan, why have a password at all?
My question sounds like a really stupid question (and it is! I'll admit that!), but it's no stupider than asking why some guy driving a van had kismet on its default settings. It all boils down to people not thinking about all the possible consequences of everything they do.
In all seriousness, they should have used GPS and this would have been a non-issue.
They're not trying to figure out where THEY are. They're collecting data so when I (since I do have an Android device) walk along that same street, my device has another data source to figure out where I am. Google's Streetview vans are zipping along making snapshots. They're also wardriving; recording what WAPs they find and where (via GPS and triangulation). With that data, my device can do some triangulation on several WAP signals and get a pretty decent idea where I am as well.
So... wardriving is evil?
I'd wager a guess that the Communications Act is his cite.
Is 1563649 a prime number?
The Communications Act is a rather large body of law; a more specific citation is necessary.
Having played with Kismet (which is what Google is using), it seems to me that it's really easy to accidentally capture packet payloads. Kismet will dump payloads in to handy pcaps by default.
Wardriving generally sucks for data capture. It's good for surveying (its interesting to see the proliferation of WAPs and secured APs at that... and some people choose really amusing SSIDs). But driving around alters signal strength which means losing packets. You're also channel hopping which means losing packets. If you really want to log people's data, you wardrive first to identify targets then come back and listen to just that (or a very small subset) of targets.
Why would they even REMOTELY think this was a good idea? What's the point of Google collecting this kind of information
Have you been asleep for the last 6 months?
It was an error, they didn't even know they were collecting it and never used it for anything. They simply filtered out the beacon data to locate wifi hot-spots. None of these wifi hot-spots were encrypted
Google themselves reported this when they discovered they were collecting way more data than they wanted. But even Google didn't look into the data and see what was there.
Governments demanded the data, and THEY began sifting it and gathering email addresses. Now WHO violate the laws? Seems to me the government busybodies sifting thru the data that google never even looked at are the guilty ones.
How in gods name can you be so unaware of the details of this incident after all this time?
Sig Battery depleted. Reverting to safe mode.
Why is that eh-veel?
Did you somehow thing your unencrypted wifi signal was private?
You DO understand its a radio don't you?
Sig Battery depleted. Reverting to safe mode.
Yes that is exactly what they are telling you.
They used common off the shelf linux utilities to collect this information. The collected beacon information, wrote it to disk with the current location information.
Rather than a "database" it was a simple flat file of location plus beacon data.
Someone forgot to filter it so that only beacon packets were written.
So in the 5-10 seconds the car was within range of an unencrypted wifi some other data might have been geo-tagged and written.
Don't try to make more of it that it was. It was not a relational database. Its no where near that sophisticated. And google was unaware that they were even collecting the information till they noticed their disk were filling faster than they should. Since all they wanted was Beacon packets they never even looked at the rest.
And guess who reported this to government: Thats right, Google.
No one goes to jail for a harmless mistake.
The only way this data gets sold is when the governments that demanded it for their witch-hunt release it under freedom of information requests.
Now run along and go turn your wireless encryption on and put your tinfoil hat back in the closet.
Sig Battery depleted. Reverting to safe mode.
Actually, the Communications Act prohibits the use of public radio waves in that way.
Which section? It's a long bit of legislation, which I'm not inclined to pore over at the moment. Since you already know, could you quote the relevant bit for us? Thanks.
Give me Classic Slashdot or give me death!
No that is wrong. The time line in that story is completely backward (something you would expect from that site).
Google didn't even know what was in the data because they didn't make use of it. Further, they reported that they were collecting beacon data well in advance. The germans only demanded it once google put out its notification to governments that they had accidentally collected other data.
Sig Battery depleted. Reverting to safe mode.
WiFi sniffing may be legal where you live but Google definitely sniffed WiFi in places where it is strictly illegal. For example, running open WiFi is strictly illegal in Finland. In the UK, use of WiFi is strictly illegal unless you are the "intended recipient" of the data under the Regulation Of Investigatory Powers Act 2000, Section 1(3): http://www.legislation.gov.uk/ukpga/2000/23/section/1
Section 1(6)(b) would allow a WiFi router to be used as a navigational beacon by end-users if the owner of the WiFi router has given "express or implied consent". However, you cannot consent to something if you don't know it exists.
It was probably easier to record the WiFi and store it as it is than try and outfit all 50,000 vehicles with enough computing power to be able to actually analyze the signal and pull out the MACs and SSIDs. More like it was just recorded on a tape and brought back to a computer center where the tape was then analyzed in a central location.
No that is wrong. The time line in that story is completely backward (something you would expect from that site).
Google didn't even know what was in the data because they didn't make use of it. Further, they reported that they were collecting beacon data well in advance. The germans only demanded it once google put out its notification to governments that they had accidentally collected other data.
Citation needed.
Here BBC News is confirming timeline from quote above:
"Google has been the subject of scrutiny from data protection agencies around the world, following news that software in its Street View cars collected personal information.
This was revealed following a request from the German data commissioner to audit all the data being collected by Street View cars "
http://www.bbc.co.uk/news/technology-11684952
That's fair enough, although in practice the PR impact of this has hurt Google far more than any fine the government could possibly impose. I'll wager the folks there are taking this very seriously, and that potential fines from regulators have nothing to do with it.
All evil is fun.
No, we don't.
GPS would give them the same data, though. It's just a matter of being able to use WiFi instead of or to augment GPS data. In short, they had a solution, thought it'd be cool to use another, now are in hot water. It's a moot point. The worse that can happen is that they be forced to dump the data and not use it and be fined. The second worse is to just be fined and somehow sanitize the data and convince the government it's kosher, the least is that they are scolded for doing it and nothing happens. Ultimately, nothing will happen to them of any real consequence anyway.
from in front of their driveway and see how fast you get thrown in jail.
Wifi is no different.
every use of the term wardriving that i have ever heard was focused on logging the location and type of wireless networks that are being broadcast. what google did involved capture of packets, which is more than just logging the location of a wireless network and calling it wardriving is too over-broad.
GPS would give them the same data, though. It's just a matter of being able to use WiFi instead of or to augment GPS data. In short, they had a solution, thought it'd be cool to use another, now are in hot water.
Ya know - now that I look at what you wrote, I noticed the emoticon. Humor; ar ar. And so here I am being all serious and unintentionally trolled. Unfortunately, it seems that all kidding aside, there are way too many people who are fearful due to a lack of understanding of the topic(s).
I think you're right; for Google all this is a moot point. But for the rest of us, I think there's a good opportunity to educate the public (and ourselves) on the issues involved. We do that with the full understanding that education always has limited effect and not everyone will benefit.
GPS would give them the same data, though. It's just a matter of being able to use WiFi instead of or to augment GPS data. In short, they had a solution, thought it'd be cool to use another, now are in hot water.
You are misunderstanding the point of collecting the MAC/SSID info. It isn't for their StreetView vehicles to get a location instead of using GPS, it is to build a database that can be used as the basis of a geolocation service that will work for devices without GPS but with Wifi. They've discussed that as the reason for the data collection and they have that service working. It is a highly useful standard part of Android, referred to as "coarse location" and it works with an Android phone's GPS radio off or in a building where it can't get a GPS fix. They also have a demo site that is usable by a desktop machine with one of the right browsers. Google is the second operator of such a service; the first was SkyHook, which was used by the early iPhones that lacked GPS. I can see 3-6 Wifi signals (all secured) other than my own from my desk in my home, and both Google and SkyHook map my desktop as being about 50' east of where it actually is, as the center of a 30 meter circle of uncertainty.
Google is very unlikely to be in "hot water" in any significant way for this, at least in the US. The FTC has already completed an investigation and cleared them of violating our virtually non-existent privacy laws. Why anyone at the FCC thinks they might have something actionable here is mystifying, since there is settled law protecting even intentional receiving of unencrypted radio transmissions. Google was slurping up everything they could recognize as Wifi signal, and a fair chunk of that turned out to be unencrypted.
It was probably easier to record the WiFi and store it as it is than try and outfit all 50,000 vehicles with enough computing power to be able to actually analyze the signal and pull out the MACs and SSIDs. More like it was just recorded on a tape and brought back to a computer center where the tape was then analyzed in a central location.
Tape is quaint.
But, Yes. Anyone with a scientific mindset knows that when you are in a position to collect data is NOT the time to refrain from collecting data. Even if you are 99% certain that you will never want 99% of what you can collect: when you are able to collect the data, collect everything you can. If you are Google, you buy disks by the truckload and you have hired a bunch of people who recently spent what should have been the best years of their lives in labs. They know that you store all the data when you can, and analyze it later. They know that a year after the wifi geolocation project is done, someone will wish they had some other information that can be teased out of a couple of seconds of raw wifi capture from a bazillion locations.
I have a real problem with a technically-minded company like Google "accidentally" logging that kind of information. Even if it was an accident, they need to be punished for that through fines or something
Based on what? Your feelings?
There is very little codified legal privacy protection in the US. The FTC can't invent new law out of thin air and your "problem" with Google. In this specific case, it is hard to argue rationally that Google did anything wrong. They captured unencrypted radio signals using an open standard encoding. The idiot "victims" might as well have been posting all of the captured secrets to a foot-high scrolling LED ticker on the front of their homes. The only meaningful difference is the wavelength of the EM radiation...
(as other companies have been punished for their privacy breaches)
Cite, please. What company has been punished by the FTC for a privacy issue? A finger-wagging and agreement to sin no more doesn't count. That's what Google got.
You have to hold companies with this much power and information accountable. Basically, you have to keep them in line and remind them to be on their toes at all times.
I don't disagree, but that's a call for the passage of laws that currently DO NOT EXIST in the US. A corporation can't keep "in line" without a definition of a line. Capturing unencrypted radio signals in inside the line as it stands.
-- You risk your karma if you criticize Google, piracy, or liberalism on Slashdot.
The irony is hilarious.
"Google was slurping up everything they could ."
Heh..they suck.